Detection method and system for unknown wifi unmanned aerial vehicle

Abstract

The invention provides a detection method and system for an unknown wifi unmanned aerial vehicle. The method comprises the following steps: when a hotspot which is not in a white list is detected through a first wifi wireless network card, determining the hotspot as a suspected target, and sending a communication parameter of the suspected target to a second wifi wireless network card; according to the serial number of the channel where the suspected target is located, data sniffing and packet capturing are carried out on the channel where the suspected target is located through a second wifi wireless network card to obtain a data packet, all messages containing the mac address of the suspected target in a preset time are screened out from the data packet, and the mac address of the suspected target is a source mac address; and under the condition that the target mac addresses in all the messages containing the mac addresses of the suspected target are the mac address of the same communication terminal, determining whether the suspected target is an unknown wifi unmanned aerial vehicle according to the network type created by the suspected target and a wifi unmanned aerial vehicle judgment strategy corresponding to the network type. According to the technical scheme provided by the invention, the wireless network security monitoring capability is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of wireless network security and drone monitoring technology, and in particular to a detection method and system for unknown WiFi drones. Background Art

[0002] With the popularization of drone technology, wireless networks have become an important means of drone communication. In sensitive areas such as airports, military bases, and important public facilities, there is an urgent need to monitor and identify unauthorized WiFi drones to ensure airspace security and prevent potential security threats. In order to meet this demand, a technical solution is needed that can monitor, identify, and analyze unknown WiFi drone activities in real time with high accuracy, low false alarm rate, and fast response.

[0003] Currently, the detection of WiFi drones mainly relies on the scanning and detection functions of a single wireless network card. Such systems usually maintain a whitelist of known legitimate devices, and when a hotspot that is not on the whitelist is detected, it is marked as a suspicious object. However, this detection method can only provide a preliminary judgment and has limited ability to further confirm whether the suspected target is an unknown WiFi drone.

[0004] The traditional single wireless network card detection method has several obvious shortcomings: first, it lacks the ability to conduct in-depth analysis of suspected targets and cannot effectively distinguish normal devices from drones; second, since it cannot monitor multiple channels at the same time, it may miss important communication data, resulting in false positives or negatives; finally, existing methods fail to make full use of MAC addresses and communication patterns to accurately locate and identify specific types of devices, such as WiFi drones. Summary of the invention

[0005] The embodiments of the present application provide a detection method and system for unknown WiFi drones, so as to solve the problem of poor wireless network security monitoring capability in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a detection method for an unknown wifi drone, including: When a hotspot not in the whitelist is detected by the first wifi wireless network card, the hotspot is determined as a suspected target, and the communication parameters of the suspected target are sent to the second wifi wireless network card, the hotspot is any wireless network node that transmits wifi signals and allows other devices to connect to it, and the communication parameters of the suspected target include the mac address of the suspected target, the channel number of the suspected target, and the encryption method; According to the channel number of the suspected target, the second WiFi wireless network card performs data sniffing and packet capture on the channel where the suspected target is located to obtain a data packet, and all messages containing the MAC address of the suspected target within a preset time are filtered out from the data packet, where the MAC address of the suspected target is the source MAC address; In the case where the target MAC address in all messages containing the MAC address of the suspected target is the MAC address of the same communication terminal, when the encryption method indicates that the network type created by the suspected target is an unencrypted open network, a video stream transmission protocol analysis is performed on the message, and whether the suspected target is an unknown WiFi drone is determined based on whether the analysis result indicates whether there is a downlink unidirectional video stream, and the video stream transmission protocol includes at least one of the real-time streaming protocol RTSP and the real-time transport protocol RTP; or, when the encryption method indicates that the network type created by the suspected target is an encrypted network, whether the suspected target is an unknown WiFi drone is determined based on whether the communication characteristics in the message conform to the communication characteristics of known WiFi drones.

[0007] Optionally, the step of determining whether the suspected target is an unknown WiFi drone based on whether the analysis result indicates whether there is a downlink unidirectional video stream includes: If the analysis result indicates that there is a downlink unidirectional video stream, it is determined that the suspected target is an unknown WiFi drone. Alternatively, if the analysis result indicates that there is no downlink unidirectional video stream, it is determined that the suspected target is not an unknown WiFi drone.

[0008] Optionally, determining whether the suspected target is an unknown WiFi drone according to whether the communication feature in the message conforms to the communication feature of a known WiFi drone includes: Extracting communication features from the message, the communication features including at least one of the following: a transmission rate of the message in an uplink and downlink direction, a size distribution of the message, a time distribution of the message, and a frame type distribution; Using a pre-trained machine learning model to classify the communication features, and obtain a classification result indicating whether the communication features meet the known WiFi drone communication features; If the classification result indicates that the communication feature conforms to the communication feature of a known WiFi drone, then the suspected target is determined to be an unknown WiFi drone; or, if the classification result indicates that the communication feature does not conform to the communication feature of a known WiFi drone, then the suspected target is determined not to be an unknown WiFi drone.

[0009] Optionally, after determining that the suspected target is an unknown wifi drone, the method further includes: The detection result of the unknown WiFi drone is sent to the second terminal device through the second WiFi wireless network card, and the detection result of the unknown WiFi drone includes a MAC address and an analysis result, or includes a MAC address and a communication feature.

[0010] Optionally, after filtering out all messages containing the MAC address of the suspected target within a preset time from the data packet, the method further includes: Determine whether the target MAC address in all messages containing the MAC address of the suspected target is the MAC address of the same communication terminal; If the target MAC address in all messages containing the MAC address of the suspected target is not the MAC address of the same communication terminal, it is determined that the suspected target is not an unknown WiFi drone.

[0011] Optionally, after determining that the suspected target is not an unknown wifi drone, the method further includes: The communication parameters of the suspected target are stored in the white list through the second Wi-Fi wireless network card, and the communication parameters also include a wireless network identifier.

[0012] Optionally, generate a whitelist, including: Acquire scanning parameters, wherein the scanning parameters include scanning mode, scanning frequency and channel list; Determine any channel in the channel list as an initial channel, select different channels in sequence according to a predefined order or in a random manner, and for each channel, perform a scanning action corresponding to the scanning mode according to the scanning frequency to obtain a scanning result including multiple hot spots; Receive labeling information of whether each hotspot is a wifi drone, filter out all hotspots that are not wifi drones based on the labeling information, and generate a whitelist of hotspots that are not wifi drones.

[0013] In a second aspect, an embodiment of the present application provides a detection system for unknown WiFi drones, including: A determination and sending module is used to determine the hotspot as a suspected target when a hotspot not in the whitelist is detected by the first wifi wireless network card, and send the communication parameters of the suspected target to the second wifi wireless network card, wherein the hotspot is any wireless network node that transmits wifi signals and allows other devices to connect to it, and the communication parameters of the suspected target include the mac address of the suspected target, the channel number of the suspected target, and the encryption method; A packet capture and screening module, used to perform data sniffing and packet capture on the channel where the suspected target is located through the second WiFi wireless network card according to the channel number where the suspected target is located, to obtain a data packet, and to screen out from the data packet all messages containing the MAC address of the suspected target within a preset time, where the MAC address of the suspected target is the source MAC address; A determination module is used to, when the target MAC address in all messages containing the MAC address of the suspected target is the MAC address of the same communication terminal, perform video stream transmission protocol analysis on the message when the encryption method indicates that the network type created by the suspected target is an unencrypted open network, and determine whether the suspected target is an unknown WiFi drone based on whether the analysis result indicates whether there is a downlink unidirectional video stream, wherein the video stream transmission protocol includes at least one of a real-time streaming protocol RTSP and a real-time transport protocol RTP; or, when the encryption method indicates that the network type created by the suspected target is an encrypted network, determine whether the suspected target is an unknown WiFi drone based on whether the communication characteristics in the message conform to the communication characteristics of known WiFi drones.

[0014] In a third aspect, an embodiment of the present application provides a computing device, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a detection method for unknown wifi drones as described in the first aspect above.

[0015] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, a detection method for an unknown wifi drone as described in the first aspect is implemented.

[0016] In an embodiment of the present application, when a hotspot that is not in the whitelist is detected by the first WiFi wireless network card, the hotspot is determined as a suspected target, and the communication parameters of the suspected target are sent to the second WiFi wireless network card, the hotspot is any wireless network node that transmits WiFi signals and allows other devices to connect to it, and the communication parameters of the suspected target include the MAC address of the suspected target and the channel number where the suspected target is located; according to the channel number where the suspected target is located, the second WiFi wireless network card performs data sniffing and packet capture on the channel where the suspected target is located to obtain a data packet, and all messages containing the MAC address of the suspected target within a preset time are filtered out from the data packet, and the MAC address of the suspected target is the source MAC address; when the target MAC address in all messages containing the MAC address of the suspected target is the MAC address of the same communication terminal, determine whether the suspected target is an unknown WiFi drone based on the network type created by the suspected target and the WiFi drone judgment strategy corresponding to the network type.

[0017] The technical solution of this application has the following beneficial effects: This application can effectively identify potential unknown WiFi drones by detecting hotspots that are not in the whitelist through the first WiFi wireless network card, and using the second WiFi wireless network card for targeted data sniffing and analysis. This dual network card collaborative working method not only improves the accuracy and efficiency of detection, but also ensures in-depth analysis of communication data in a specific channel, thereby accurately screening out all network traffic related to suspected targets within a preset time window. Through the identification of a 1-to-1 communication mode, the interference of ordinary multi-terminal wireless networks is eliminated, and the recognition accuracy is improved.

[0018] Furthermore, in an embodiment of the present application, when the encryption method indicates that the network type created by the suspected target is an unencrypted open network, a video stream transmission protocol analysis is performed on the message. If the analysis result indicates that there is a downlink unidirectional video stream, it is determined that the suspected target is an unknown wifi drone. Alternatively, if the analysis result indicates that there is no downlink unidirectional video stream, it is determined that the suspected target is not an unknown wifi drone. The video stream transmission protocol includes at least one of the real-time streaming protocol RTSP and the real-time transport protocol RTP.

[0019] According to the above method, by identifying the downlink unidirectional video stream communication mode, it is distinguished from other communication scenarios and the recognition accuracy is improved.

[0020] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 A flow chart of a detection method for unknown wifi drones provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of a detection system for unknown WiFi drones provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0024] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The sequence numbers of the operations, such as 11, 12, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to different types.

[0025] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0026] Figure 1 A flow chart of a detection method for unknown WiFi drones provided in an embodiment of the present application is as follows: Figure 1 As shown, the method includes: Step 101: When a hotspot that is not in the whitelist is detected by the first wifi wireless network card, the hotspot is determined as a suspected target, and the communication parameters of the suspected target are sent to the second wifi wireless network card.

[0027] In this step, the first WiFi wireless network card is used to perform a network scanning task, which can identify and collect information about all available wireless access points (i.e., hotspots) in the surrounding environment. A hotspot is any wireless network node that transmits a WiFi signal and allows other devices to connect to it. When a hotspot that is not in the whitelist is detected, the hotspot is considered a potential security threat and is marked as a suspected target. The communication parameters of the suspected target include the MAC address of the suspected target, the channel number of the suspected target, and the encryption method.

[0028] In actual operation, the first WiFi wireless network card will continuously monitor the WiFi signal in the environment, and quickly screen out unknown or unauthorized hotspots by comparing it with the preset whitelist. Once a suspected target is found, the system will automatically record its communication parameters and pass this information to the second WiFi wireless network card through the internal communication mechanism for more in-depth data collection and analysis.

[0029] For example, in an airport security monitoring scenario, the first WiFi wireless network card is installed in a fixed position to monitor the surrounding airspace around the clock. Suppose a drone enters the monitoring area without authorization and turns on its WiFi module to try to establish a communication link. At this time, since the drone's WiFi signal does not appear in the whitelist, it will immediately be marked as a suspected target and a further inspection process will be initiated.

[0030] Step 102: According to the channel number where the suspected target is located, data sniffing and packet capture are performed on the channel where the suspected target is located through the second WiFi wireless network card to obtain a data packet, and all messages containing the MAC address of the suspected target within a preset time are filtered out from the data packet, where the MAC address of the suspected target is the source MAC address.

[0031] In this step, data sniffing is a technique that refers to capturing and analyzing transmitted data packets at the network level to understand the content and pattern of network traffic. A channel is a specific frequency range for radio wave transmission. In a WiFi network, different channels can reduce interference and allow multiple networks to coexist. The MAC address appears in the packet header as the source address, indicating the sender of the data.

[0032] In actual operation, after receiving the communication parameters of the suspected target, the second WiFi wireless network card will switch to the corresponding channel and start monitoring all data transmission activities on that channel. The system will capture all data packets from the suspected target within the preset time window and filter out those packets containing the suspected target MAC address as the source address for subsequent analysis.

[0033] For example, continuing with the previous example, when the drone’s WiFi signal is flagged as a suspected target, the second WiFi wireless network card will adjust its settings to synchronize with the same channel used by the drone and then start collecting all packets over a period of time. This step helps to obtain detailed information about the communication behavior of the suspected target.

[0034] Step 103: When the target MAC address in all messages containing the MAC address of the suspected target is the MAC address of the same communication terminal, determine whether the suspected target is an unknown WiFi drone based on the network type created by the suspected target and the WiFi drone judgment strategy corresponding to the network type.

[0035] In this step, MAC address matching is a method used in network communication to verify whether there is a communication relationship between two devices. If the destination MAC addresses of multiple data packets are the same, it indicates that there is a fixed communication terminal. The WiFi drone judgment strategy is a set of rules based on network type and other behavioral characteristics to evaluate whether a wireless node may be an unknown WiFi drone.

[0036] In actual operation, the system will check all data packets containing the suspected target MAC address as the source address to determine whether their target MAC addresses point to the same communication terminal. Combined with the network type and characteristics created by the suspected target, and according to the predefined WiFi drone judgment strategy, the system can make a final judgment to confirm whether the suspected target is an unknown WiFi drone.

[0037] For example, continuing with the above case, analysis shows that all packets from the suspected drone were sent to the same ground control station. Based on the common network configuration and operation habits of drones, the system applies the WiFi drone judgment strategy and determines that the suspected target is most likely an unauthorized WiFi drone, and triggers an alarm to notify security personnel to take action.

[0038] This three-step process uses the first WiFi wireless network card to quickly screen abnormal hotspots, the second WiFi wireless network card focuses on data collection on specific channels, and finally achieves accurate identification of unknown WiFi drones through in-depth analysis of data packets. This method not only improves the efficiency and accuracy of detection, but also reduces the possibility of false alarms, effectively enhancing the ability to protect air safety in sensitive areas.

[0039] In order to solve the problem of insufficient accuracy in detecting unknown WiFi drones in traditional methods, in some embodiments, the communication parameters of the suspected target in step 103 also include an encryption method, and the network type created by the suspected target and the WiFi drone judgment strategy corresponding to the network type are used to determine whether the suspected target is an unknown WiFi drone, including: When the encryption method indicates that the network type created by the suspected target is an unencrypted open network, a video stream transmission protocol analysis is performed on the message. If the analysis result indicates that there is a downlink unidirectional video stream, it is determined that the suspected target is an unknown WiFi drone. Alternatively, if the analysis result indicates that there is no downlink unidirectional video stream, it is determined that the suspected target is not an unknown WiFi drone. The video stream transmission protocol includes at least one of a real-time streaming protocol RTSP and a real-time transport protocol RTP.

[0040] In this embodiment, in order to further improve the accuracy of identifying suspected targets, in addition to the MAC address and channel number, the encryption method of the network type created by the suspected target is also considered. By analyzing the encryption method, it is possible to more accurately determine whether the network is likely to be created by an unknown WiFi drone, and adjust the subsequent analysis strategy accordingly.

[0041] In an embodiment of the present application, when the encryption method indicates that the suspected target has created an unencrypted open network, the system will perform additional data packet content analysis, especially for video streaming protocols (such as real-time streaming protocol RTSP or real-time transport protocol RTP). This analysis is intended to confirm whether there is a downlink unidirectional video stream, that is, a continuous video data transmission from the suspected target to the ground control station or other receiving device. If such a video stream is detected, given that drones usually send real-time video feedback to the ground station, it can be reasonably inferred that the suspected target is likely to be an unknown WiFi drone. On the contrary, if no such video stream is found, it can be preliminarily ruled out as an unknown WiFi drone.

[0042] The following is a specific embodiment: In a security monitoring scenario of a large commercial park, the second WiFi wireless network card has captured data packets from a suspected WiFi drone that is not on the whitelist. Further analysis shows that the suspected target has created a completely open and unencrypted WiFi network. According to the pre-set WiFi drone judgment strategy, the system begins to perform video stream transmission protocol analysis on the captured data packets. After detailed protocol analysis, downlink unidirectional video streams that comply with the RTP standard are found. These video streams are being transmitted from the suspected target to a fixed IP address, which is likely the location of the ground control station. Based on this information, combined with other behavioral characteristics, the system ultimately determines that the suspected target is an unauthorized WiFi drone and immediately notifies the security team to take appropriate measures to ensure the safety of the park.

[0043] In order to solve the problem of insufficient accuracy in detecting unknown WiFi drones in traditional methods, in some embodiments, the communication parameters of the suspected target in step 103 also include an encryption method, and the network type created by the suspected target and the WiFi drone judgment strategy corresponding to the network type are used to determine whether the suspected target is an unknown WiFi drone, and further include: When the encryption method indicates that the network type created by the suspected target is an encrypted network, communication features are extracted from the message, and the communication features include at least one of the following: message transmission rate in the uplink and downlink directions, message size distribution, message time distribution, and frame type distribution; the communication features are classified using a pre-trained machine learning model to obtain a classification result indicating whether the communication features meet the communication features of known wifi drones; if the classification result indicates that the communication features meet the communication features of known wifi drones, it is determined that the suspected target is an unknown wifi drone, or, if the classification result indicates that the communication features do not meet the communication features of known wifi drones, it is determined that the suspected target is not an unknown wifi drone.

[0044] In this embodiment, the encryption method refers to the security protocol used by the wireless network, such as WEP, WPA or WPA2, which is used to protect the security of data transmission. "Communication characteristics" refer to data attributes that can describe and quantify wireless communication behavior, including but not limited to the transmission rate in the uplink and downlink directions (a measure of the speed of the data flow), the message size distribution (the proportion of data packets of different sizes), the message time distribution (the time interval pattern of data packet transmission), and the frame type distribution (the proportion of various types of data frames, such as management frames, control frames and data frames). These communication characteristics can be used to describe the behavior pattern of a wireless device and are an important basis for identifying and classifying device types.

[0045] In an embodiment of the present application, when the suspected target creates an encrypted network, the system will no longer rely on simple MAC address matching and video stream analysis, but will dig deep into the communication features in the captured data packets. After these features are extracted, they will be passed as input to a pre-trained machine learning model. The model is trained based on a large number of known WiFi drone samples and can identify communication patterns that match known WiFi drones. By comparing the newly captured communication features with the knowledge learned by the model, the system can determine whether the suspected target meets the behavioral characteristics of known WiFi drones. If the classification result shows that the communication features match, it is considered that the suspected target may be an unknown WiFi drone; otherwise, the possibility of it being an unknown WiFi drone is ruled out.

[0046] The following is a specific embodiment: In an airspace monitoring scenario at a military base, the second WiFi wireless network card has captured a data packet from a suspected WiFi drone that is not on the whitelist. Further analysis shows that the suspected target created a WiFi network encrypted with WPA2. Based on the pre-set WiFi drone judgment strategy, the system begins to extract deeper communication features from the captured data packets. Specifically, the system measures the transmission rate in the uplink and downlink directions, counts the message size distribution, records the message time distribution, and analyzes the frame type distribution.

[0047] Next, these communication features are input into a pre-trained machine learning model. This model is trained on a large number of data sets of known WiFi drones, and it can effectively distinguish different types of wireless devices. After the model's classification processing, the results show that the captured communication features are highly consistent with the behavior patterns of known WiFi drones, especially the uplink and downlink transmission rates show obvious asymmetry and specific time distribution patterns, which are typical operating characteristics of drones. Therefore, the system finally confirmed that the suspected target was an unauthorized WiFi drone and triggered an alarm to notify security personnel to take necessary actions.

[0048] In order to further improve the utilization efficiency of the unknown WiFi drone detection results and ensure that relevant security measures can respond in a timely manner, in some embodiments, after determining that the suspected target is an unknown WiFi drone in step 103, the method further includes: The detection result of the unknown WiFi drone is sent to the second terminal device through the second WiFi wireless network card, and the detection result of the unknown WiFi drone includes a MAC address and an analysis result, or includes a MAC address and a communication feature.

[0049] In this embodiment, the second terminal device refers to a device used to receive and process alarm information and technical data from the monitoring system, such as a computer in a security control center, a mobile command platform, or a dedicated security management system. The detection results are not limited to simple confirmation information (such as whether it is an unknown WiFi drone), but also include detailed MAC addresses (used to uniquely identify wireless devices) and in-depth analysis results or communication characteristics. The analysis results can be conclusions about the behavior patterns of drones, such as whether there is video streaming transmission; while the communication characteristics provide a more detailed description of data packet attributes, such as transmission rate, message size distribution, etc., which are very important for subsequent threat assessment and countermeasure formulation.

[0050] In an embodiment of the present application, once the system confirms that the suspected target is an unknown WiFi drone through the above steps, it will generate a detailed detection report. This report contains the MAC address of the unknown WiFi drone and the basis for its identification as a drone, which may be based on the analysis results of the behavior pattern, or specific communication features extracted from the captured data packets. The system then uses the second WiFi wireless network card to send this detection report to the designated second terminal device. This process ensures that relevant information can be quickly and accurately delivered to personnel responsible for security monitoring and emergency response, so that they can take appropriate actions based on the information received.

[0051] The following is a specific embodiment: In a security monitoring system at a large airport, when the second WiFi wireless network card captured and analyzed a data packet from a suspected WiFi drone that was not on the whitelist, the system finally confirmed that the hotspot did belong to an unauthorized WiFi drone based on a pre-set judgment strategy. Subsequently, the system automatically generated a detailed detection report, which included the drone's MAC address, uplink and downlink transmission rates, message size distribution and other key communication features, as well as the behavioral pattern analysis results obtained through the machine learning model, indicating the existence of a downlink unidirectional video stream.

[0052] Next, the system sent the detection report to the dedicated terminal device of the airport security command center through the second WiFi wireless network card. After receiving the notification, the security team immediately activated the emergency plan, dispatched ground patrols to the suspected drone activity area for on-site verification, and coordinated with the air traffic control department to adjust the flight path to avoid potential conflicts. In addition, technicians also used the detailed information in the detection report to track the location of the drone operator and prepare necessary legal procedures. This real-time feedback mechanism greatly improves the speed and accuracy of responding to unknown WiFi drone threats and ensures the safety and order of airport operations.

[0053] In order to further improve the accuracy of identifying suspected WiFi drones and reduce false positives, in some embodiments, after filtering out all messages containing the MAC address of the suspected target within a preset time from the data packet in step 102, the method further includes: Determine whether the target MAC address in all messages containing the MAC address of the suspected target is the MAC address of the same communication terminal; if the target MAC address in all messages containing the MAC address of the suspected target is not the MAC address of the same communication terminal, it is determined that the suspected target is not an unknown WiFi drone.

[0054] In this embodiment, the target MAC address refers to the MAC address of the receiver in the data packet, which identifies the destination device of the data packet. If the target MAC addresses of multiple data packets are the same, it indicates that these data packets are sent to the same communication terminal. This consistency check can help distinguish between ordinary wireless network traffic and communication patterns unique to drones, because drones usually maintain communication with a fixed ground control station, that is, all uplink or downlink data packets will point to the same MAC address. In addition, a communication terminal refers to a device participating in the communication, such as a two-way communication link between a drone and its corresponding ground control station.

[0055] In an embodiment of the present application, after the second WiFi wireless network card completes channel monitoring and filters out all data packets containing suspected target MAC addresses within a preset time, the system will further analyze the target MAC addresses in these data packets. The purpose is to confirm whether all these data packets are sent to the same communication terminal. If so, the possibility that the suspected target is an unknown WiFi drone is increased; conversely, if the target MAC address is inconsistent, this may mean that what is captured is regular network traffic, rather than drone-specific communication behavior. In this case, the system will rule out the possibility that the suspected target is an unknown WiFi drone and terminate the further investigation process.

[0056] The following is a specific embodiment: In a security monitoring scenario of a city park, the second WiFi wireless network card has completed the data packet capture on a certain channel and screened out all the messages containing the suspected target MAC address. Next, the system begins to analyze the target MAC addresses of these data packets. Assume that after analysis, it is found that although the source MAC addresses (suspected targets) of all data packets are the same, their target MAC addresses are scattered and point to multiple different communication terminals, which is inconsistent with the typical one-to-one communication mode of drones. Therefore, based on this feature, the system concludes that the suspected target is not an unknown WiFi drone, but other types of wireless devices, such as communications between smart watches, mobile phones, or other portable electronic devices that may be carried by tourists.

[0057] In order to solve the false alarm problem and further improve the adaptive ability and accuracy of the system, in some embodiments, after determining that the suspected target is not an unknown WiFi drone, the method further includes: The communication parameters of the suspected target are stored in the white list through the second Wi-Fi wireless network card.

[0058] In this embodiment, the communication parameters include not only the MAC address and channel number of the suspected target, but also extend to the wireless network identifier (Service Set Identifier, SSID), which is the name used to distinguish different wireless networks. By recording these detailed communication parameters, the system can more accurately identify and remember legitimate wireless devices or networks, thereby avoiding unnecessary detection and alarms on them in the future. The whitelist is a database containing all known safe devices or networks, which is used to quickly screen and exclude normal traffic, ensuring that monitoring resources are focused on potential threats.

[0059] In the embodiment of the present application, when the system confirms through a series of analyses that a suspected target is not an unknown WiFi drone, it will not simply ignore the device, but take active learning measures. Specifically, the second WiFi wireless network card will store the complete communication parameters of the suspected target, including its MAC address, the channel number used, and the wireless network identifier, in the whitelist. This update operation allows the system to directly mark the same device or network as a known and harmless object if it encounters the same device or network again during future scans, without initiating a complex detection process. This not only reduces the processing burden of the system, but also reduces the possibility of false alarms, thereby improving the overall security management efficiency.

[0060] The following is a specific embodiment: In a smart city security monitoring system, the second WiFi wireless network card captured a hotspot signal that was not in the whitelist. After detailed data packet analysis, the system confirmed that the hotspot was not an unknown WiFi drone, but may be a portable device such as a smartphone or smartwatch of an ordinary user. In order to prevent repeated checks on the device in the future, the system decided to include its communication parameters in the whitelist. Therefore, in addition to recording the MAC address of the device and the channel number used, the system also specifically recorded its wireless network identifier (for example, the home Wi-Fi SSID to which the phone is connected). In this way, when this user enters the monitoring area again, even if the signal sent by his device is captured by the first WiFi wireless network card, since its communication parameters are already in the whitelist, the system will directly skip further analysis steps, ensuring efficient resource utilization and accurate security assessment.

[0061] In order to solve the problem of incomplete data or false positives during the whitelist generation process and further improve the automation and accuracy of the system, in some embodiments, generating a whitelist includes: Obtain scanning parameters, wherein the scanning parameters include a scanning mode, a scanning frequency, and a channel list; determine any channel in the channel list as an initial channel, and select different channels in turn according to a predefined order or a random manner, and for each channel, perform a scanning action corresponding to the scanning mode according to the scanning frequency to obtain a scanning result including multiple hotspots; receive labeling information of whether each hotspot is a wifi drone, and based on the labeling information, filter out all hotspots that are not wifi drones, and generate a whitelist list containing all hotspots that are not wifi drones.

[0062] In this embodiment, scanning parameters refer to specific settings used to guide wireless network scanning, mainly including the following: scanning mode defines the scanning method, such as active scanning (sending a probe request and waiting for a response) or passive scanning (listening to broadcast frames on the channel), which determines how the system discovers surrounding wireless access points. The scanning frequency specifies the interval or rate of the scanning operation to ensure that the system can regularly update its understanding of the environment. The channel list lists all WiFi channels that need to be monitored so that the system can conduct a comprehensive search on different frequency bands. The annotation information is a label about the nature of each hotspot provided by artificial or other intelligent means, clearly indicating which hotspots belong to WiFi drones and which do not. This information is crucial for building an accurate whitelist because it helps the system distinguish between legitimate devices and potential threats.

[0063] In an embodiment of the present application, in order to generate a reliable whitelist, the system first needs to collect detailed scanning parameters to ensure full coverage of possible wireless access points. Then, it selects an initial channel from the channel list to start scanning, and switches to other channels according to a preset order or randomly. Each scan follows the specified scanning mode and frequency. During this process, the system records all hotspot information as preliminary scanning results. Next, by receiving externally provided annotation information, the system can identify which hotspots are not WiFi drones and add these non-threatening hotspots to the whitelist. This process not only improves the accuracy of the whitelist, but also enhances the system's self-learning ability, enabling it to more effectively filter out known security devices in the future.

[0064] The following is a specific embodiment: In a security management scenario of a large commercial park, the administrator wants to create a whitelist to distinguish legitimate wireless devices in the park from potential unknown WiFi drones. To this end, the system first configures the scanning parameters, selects the active scanning mode, sets the scanning frequency to once per minute, and lists all common 2.4GHz and 5GHz WiFi channels as the channel list. The system then starts the scanning process, starting with the first channel in the 2.4GHz band, and gradually switches to other channels in a predetermined order, while maintaining the specified scanning frequency to ensure that no active wireless access points are missed.

[0065] As the scan progressed, the system captured a large number of hotspot information, including employee smartphones, visitor tablets, and various IoT devices deployed in the campus. In order to determine which hotspots should not be considered threats, the administrator provided annotation information through a dedicated interface and marked known non-drone devices. Based on these annotations, the system automatically screened out all hotspots that were not WiFi drones and added their communication parameters (such as MAC addresses, SSIDs, etc.) to the whitelist.

[0066] Finally, the generated whitelist not only includes existing legitimate devices, but also has the ability to self-update. When new non-threatening devices enter the campus, if they are correctly marked in subsequent scans, they will also be automatically included in the whitelist. This approach greatly simplifies the workload of administrators, while also improving the reliability and responsiveness of the entire security system, ensuring that only truly suspicious wireless activities will trigger further inspections or alarm mechanisms.

[0067] Figure 2 A structural diagram of a detection system for unknown WiFi drones provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the system includes: The determination and sending module 21 is used to determine the hotspot as a suspected target when a hotspot not in the white list is detected by the first wifi wireless network card, and send the communication parameters of the suspected target to the second wifi wireless network card, wherein the hotspot is any wireless network node that transmits wifi signals and allows other devices to connect to it, and the communication parameters of the suspected target include the mac address of the suspected target, the channel number of the suspected target and the encryption method; The packet capture and screening module 22 is used to perform data sniffing and packet capture on the channel where the suspected target is located through the second WiFi wireless network card according to the channel number where the suspected target is located, to obtain a data packet, and to screen out all messages containing the MAC address of the suspected target within a preset time from the data packet, where the MAC address of the suspected target is the source MAC address; The determination module 23 is used to determine whether the suspected target is an unknown WiFi drone according to the network type created by the suspected target and the WiFi drone judgment strategy corresponding to the network type when the target MAC address in all messages containing the MAC address of the suspected target is the MAC address of the same communication terminal; According to the network type created by the suspected target and the wifi drone judgment strategy corresponding to the network type, determining whether the suspected target is an unknown wifi drone includes: When the encryption method indicates that the network type created by the suspected target is an unencrypted open network, a video stream transmission protocol analysis is performed on the message, and whether the suspected target is an unknown WiFi drone is determined based on whether the analysis result indicates whether there is a downlink unidirectional video stream, and the video stream transmission protocol includes at least one of the real-time streaming protocol RTSP and the real-time transport protocol RTP; or, when the encryption method indicates that the network type created by the suspected target is an encrypted network, whether the suspected target is an unknown WiFi drone is determined based on whether the communication characteristics in the message conform to the communication characteristics of known WiFi drones.

[0068] Figure 2 The detection system for unknown wifi drones can be performed Figure 1 The implementation principle and technical effect of the detection method for unknown WiFi drones described in the illustrated embodiment will not be repeated. The specific manner in which each module and unit performs operations in the detection system for unknown WiFi drones in the above embodiment has been described in detail in the embodiment of the method, and will not be elaborated here.

[0069] In one possible design, Figure 2 A detection system for unknown wifi drones in the illustrated embodiment can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32 .

[0070] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0071] The processing component 32 is used to: when a hotspot not in the whitelist is detected by the first wifi wireless network card, determine the hotspot as a suspected target, and send the communication parameters of the suspected target to the second wifi wireless network card, the hotspot is any wireless network node that transmits wifi signals and allows other devices to connect to it, and the communication parameters of the suspected target include the mac address of the suspected target, the channel number of the suspected target and the encryption method; according to the channel number of the suspected target, sniff and capture the channel where the suspected target is located through the second wifi wireless network card to obtain a data packet, and filter out all messages containing the mac address of the suspected target within a preset time from the data packet, and the mac address of the suspected target is the source m ac address; when the target MAC address in all messages containing the MAC address of the suspected target is the MAC address of the same communication terminal, when the encryption method indicates that the network type created by the suspected target is an unencrypted open network, a video stream transmission protocol analysis is performed on the message, and whether there is a downlink unidirectional video stream is determined based on the analysis result to determine whether the suspected target is an unknown WiFi drone, and the video stream transmission protocol includes at least one of the real-time streaming protocol RTSP and the real-time transport protocol RTP; or, when the encryption method indicates that the network type created by the suspected target is an encrypted network, whether the suspected target is an unknown WiFi drone is determined based on whether the communication characteristics in the message conform to the communication characteristics of known WiFi drones.

[0072] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0073] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as random access memory (RAM), static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0074] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0075] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0076] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0077] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0078] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 A detection method for unknown WiFi drones in the illustrated embodiment.

[0079] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0080] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0081] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0082] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A detection method for unknown WiFi drones, characterized in that: Applied to the first terminal device, including: When a hotspot not in the whitelist is detected by the first wifi wireless network card, the hotspot is determined as a suspected target, and the communication parameters of the suspected target are sent to the second wifi wireless network card, the hotspot is any wireless network node that transmits wifi signals and allows other devices to connect to it, and the communication parameters of the suspected target include the mac address of the suspected target, the channel number of the suspected target, and the encryption method; According to the channel number of the suspected target, the second WiFi wireless network card performs data sniffing and packet capture on the channel where the suspected target is located to obtain a data packet, and all messages containing the MAC address of the suspected target within a preset time are filtered out from the data packet, where the MAC address of the suspected target is the source MAC address; In the case where the target MAC address in all messages containing the MAC address of the suspected target is the MAC address of the same communication terminal, when the encryption method indicates that the network type created by the suspected target is an unencrypted open network, a video stream transmission protocol analysis is performed on the message, and whether the suspected target is an unknown WiFi drone is determined based on whether the analysis result indicates whether there is a downlink unidirectional video stream, and the video stream transmission protocol includes at least one of the real-time streaming protocol RTSP and the real-time transport protocol RTP; or, when the encryption method indicates that the network type created by the suspected target is an encrypted network, whether the suspected target is an unknown WiFi drone is determined based on whether the communication characteristics in the message conform to the communication characteristics of known WiFi drones.

2. The method according to claim 1, characterized in that: The step of determining whether the suspected target is an unknown WiFi drone based on the analysis result indicating whether there is a downlink unidirectional video stream comprises: If the analysis result indicates that there is a downlink unidirectional video stream, it is determined that the suspected target is an unknown WiFi drone. Alternatively, if the analysis result indicates that there is no downlink unidirectional video stream, it is determined that the suspected target is not an unknown WiFi drone.

3. The method according to claim 1, characterized in that The determining whether the suspected target is an unknown WiFi drone according to whether the communication characteristics in the message conform to the communication characteristics of a known WiFi drone includes: Extracting communication features from the message, the communication features including at least one of the following: a transmission rate of the message in an uplink and downlink direction, a size distribution of the message, a time distribution of the message, and a frame type distribution; Using a pre-trained machine learning model to classify the communication features, and obtain a classification result indicating whether the communication features meet the known WiFi drone communication features; If the classification result indicates that the communication feature conforms to the communication feature of a known WiFi drone, then the suspected target is determined to be an unknown WiFi drone; or, if the classification result indicates that the communication feature does not conform to the communication feature of a known WiFi drone, then the suspected target is determined not to be an unknown WiFi drone.

4. The method according to claim 2 or 3, characterized in that: After determining that the suspected target is an unknown WiFi drone, the method further includes: The detection result of the unknown WiFi drone is sent to the second terminal device through the second WiFi wireless network card, and the detection result of the unknown WiFi drone includes a MAC address and an analysis result, or includes a MAC address and a communication feature.

5. The method according to claim 1, characterized in that After filtering out all messages containing the MAC address of the suspected target within a preset time from the data packet, the method further includes: Determine whether the target MAC address in all messages containing the MAC address of the suspected target is the MAC address of the same communication terminal; If the target MAC address in all messages containing the MAC address of the suspected target is not the MAC address of the same communication terminal, it is determined that the suspected target is not an unknown WiFi drone.

6. The method according to claim 2, 3 or 5, characterized in that: After determining that the suspected target is not an unknown WiFi drone, the method further includes: The communication parameters of the suspected target are stored in the white list through the second Wi-Fi wireless network card, and the communication parameters also include a wireless network identifier.

7. The method according to claim 1, characterized in that Generate a whitelist, including: Acquire scanning parameters, wherein the scanning parameters include scanning mode, scanning frequency and channel list; Determine any channel in the channel list as an initial channel, select different channels in sequence according to a predefined order or in a random manner, and for each channel, perform a scanning action corresponding to the scanning mode according to the scanning frequency to obtain a scanning result including multiple hot spots; Receive labeling information of whether each hotspot is a wifi drone, filter out all hotspots that are not wifi drones based on the labeling information, and generate a whitelist of hotspots that are not wifi drones.

8. A detection system for unknown WiFi drones, characterized in that: Applied to the first terminal device, including: A determination and sending module is used to determine the hotspot as a suspected target when a hotspot not in the whitelist is detected by the first wifi wireless network card, and send the communication parameters of the suspected target to the second wifi wireless network card, wherein the hotspot is any wireless network node that transmits wifi signals and allows other devices to connect to it, and the communication parameters of the suspected target include the mac address of the suspected target, the channel number of the suspected target, and the encryption method; A packet capture and screening module, used to perform data sniffing and packet capture on the channel where the suspected target is located through the second WiFi wireless network card according to the channel number where the suspected target is located, to obtain a data packet, and to screen out from the data packet all messages containing the MAC address of the suspected target within a preset time, where the MAC address of the suspected target is the source MAC address; A determination module is used to, when the target MAC address in all messages containing the MAC address of the suspected target is the MAC address of the same communication terminal, perform video stream transmission protocol analysis on the message when the encryption method indicates that the network type created by the suspected target is an unencrypted open network, and determine whether the suspected target is an unknown WiFi drone based on whether the analysis result indicates whether there is a downlink unidirectional video stream, wherein the video stream transmission protocol includes at least one of a real-time streaming protocol RTSP and a real-time transport protocol RTP; or, when the encryption method indicates that the network type created by the suspected target is an encrypted network, determine whether the suspected target is an unknown WiFi drone based on whether the communication characteristics in the message conform to the communication characteristics of known WiFi drones.

9. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a detection method for unknown wifi drones as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, a detection method for an unknown wifi drone as described in any one of claims 1 to 7 is implemented.

Images