A method for detecting and protecting hidden cameras based on wireless network traffic

Abstract

The present invention discloses a method for detecting and protecting hidden cameras based on wireless network traffic, and relates to the field of information security technology. The method comprises: obtaining wireless network data packets in a local area network, filtering and grouping the wireless network data packets, detecting whether there is a wireless camera in the local area network, and protecting the shooting behavior of the wireless camera. The present invention can effectively detect wireless cameras, and the detection results have extremely high accuracy, and can make corresponding protective measures to protect privacy and security.

Description

Background Art

[0002] In recent years, with the rapid development of Internet technology and communication technology, cameras are increasingly used in various industries, involving security, monitoring and other fields. However, wireless camera surveillance in private spaces has brought great harm. For example, hotels, locker rooms, conference rooms and other places with high privacy requirements may be maliciously spied on by wireless cameras.

[0003] Most of these cameras are wireless cameras, which are small in size and upload data in real time, so they are very hidden and difficult to erase. Therefore, how to effectively detect whether there are wireless cameras taking secret photos around and take precautions is a technical problem that the industry needs to solve urgently. Summary of the invention

[0004] The present invention provides a method for detecting and protecting a hidden camera based on wireless network traffic, which detects whether a wireless camera exists in a connected local area network and prevents the camera from continuing to work by information means.

[0005] The technical solution adopted by the present invention is as follows:

[0006] A method for detecting and protecting hidden cameras based on wireless network traffic, comprising:

[0007] 1) Obtain wireless network data packet flow information within the spatial local area network;

[0008] 2) The filtered wireless network data packet flow information is grouped into data streams according to the source IP address and the destination IP address in the IP frame header information, and each group of data streams corresponds to the same type of devices connected to the local area network;

[0009] 3) Extract the multi-dimensional feature vector of each group of data flows, including the source IP packet ratio, the average time for packets to change target IP, the mean and standard deviation of packet duration, the mean and standard deviation of packet sending time interval, the mean and standard deviation of packet length, the information entropy of the service type to which the packet belongs, and the mean and standard deviation of packet survival time;

[0010] 4) Using the multidimensional feature vector obtained in step 3) to train the XgBoost model, during training, the multidimensional feature vector corresponding to the wireless camera device is marked as a positive sample, and the multidimensional feature vectors corresponding to the remaining devices are marked as negative samples; the trained XgBoost model can realize the binary classification of the data stream;

[0011] 5) Obtain the wireless network data packet flow information in the local area network of the space to be detected, use the methods in steps 2) and 3) to extract the multi-dimensional feature vector corresponding to the data flow of all connected devices in the local area network of the detection space, and use the trained XgBoost model to determine whether there is a wireless camera in the space to be detected; if there is a wireless camera, launch a flood attack on the local area network of the space to be detected to make the wireless camera device offline.

[0012] Furthermore, the multidimensional feature vector described in step 3) is specifically:

[0013] a. The proportion of source IP packets in the data flow is L:

[0014]

[0015] Among them, N u Indicates the number of source IP packets contained in the data flow, and N indicates the total number of packets contained in the data flow;

[0016] b. Get the timestamp t of the target IP address of the data packet in the data stream i , forming the target IP change time sequence C of the data flow = {t1, t2, ..., t i ,...t m}, t m Indicates the timestamp of the data packet corresponding to the mth target IP in the data stream changing the target IP; uses the time series C to calculate the average time μ for the data packet to change the target IP in the data stream tc :

[0017] tc i =t i+1 -t i

[0018]

[0019] Among them, tc i is the time difference between the packets corresponding to the i+1th target IP and the ith target IP, μ tc It is the average time for a data packet to change its destination IP;

[0020] c. Mean value μ of packet duration d and standard deviation D d :

[0021]

[0022]

[0023] Among them, d i is the duration of the i-th data packet in the data stream;

[0024] d. The mean value of the time interval between data packet transmissions μ tk and standard deviation D tk :

[0025] tk i =k i -k i-1

[0026]

[0027]

[0028] Among them, k i is the sending time of the ith data packet in the data stream, tk i The sending time difference between the i-th data packet and the i-1-th data packet in the data stream;

[0029] e. Mean value of packet length μ l and standard deviation D l :

[0030]

[0031]

[0032] Among them, l i is the length of the i-th data packet in the data stream;

[0033] f. Each data packet in the data stream corresponds to a service type, and the frequency of each service type is calculated. i , according to the frequency f i Calculate the information entropy E(f) of the service type to which the data packet belongs:

[0034]

[0035] Where w is the number of service types, f i is the frequency of occurrence of the i-th service type;

[0036] g. Mean value μ of packet survival time tt and standard deviation D tt :

[0037]

[0038]

[0039] Among them, tt i is the lifetime of the ith data packet in the data stream.

[0040] Furthermore, when a wireless camera is detected in the spatial LAN, its MAC address is obtained from the corresponding data stream of the wireless camera, and the target router information and the channel where the wireless camera transmits information are obtained based on the MAC learning mechanism of the LAN switch MAC table; a protection request is sent to the server, and after receiving the instruction, the server continuously sends a large number of forged MAC addresses to the target channel, so that the MAC table in the switch is constantly aged, and the MAC address of the wireless camera is removed from the MAC table of the switch, so that the information of the wireless camera cannot be sent normally from the switch channel, thereby achieving the purpose of taking the wireless camera offline from the LAN.

[0041] The technical solution disclosed in the present invention has the following beneficial effects: the features of the traditional method for detecting wireless cameras are relatively simple, the accuracy is low, and there is a lack of means to respond immediately to the behavior of secretly filming. The present invention obtains wireless network data packets in the local area network, filters and groups the wireless network data packets, and extracts the eleven-dimensional feature vectors of each group of data streams. From multiple aspects of features, it can effectively detect whether there is a wireless camera in the connected local area network, with high detection accuracy, and can be taken offline through flooding attacks, so that it cannot continue to film secretly. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of a system architecture shown in an embodiment of the present invention;

[0043] Figure 2 The present invention is a flowchart of a method for detecting and protecting hidden cameras based on wireless network traffic according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] Example embodiments will be described more fully below with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0045] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the steps. For example, some steps may be decomposed, while some steps may be combined or partially combined, so the actual execution order may change according to the actual situation.

[0046] In view of the above problems, an exemplary embodiment of the present invention discloses a hidden camera detection and protection method based on wireless network traffic. Figure 1 A system architecture diagram showing the operating environment of this exemplary embodiment.

[0047] refer to Figure 1 As shown, the system architecture 100 may include a data capture device 110, a data analysis device 120, and a data sending device 130. The data capture device 110 may be a device with network communication function, such as a mobile phone, a tablet computer, a personal computer, etc. The data capture device 110 is located in a local area network and is used to capture network data packets in the local area network. The local area network to be detected includes but is not limited to the local area network of a hotel, a locker room, and a conference room. The data capture device 110 and the data analysis device 120 can be connected through a wireless communication link, so that the data capture device 110 sends the captured network data packet to the data analysis device 120. The data analysis device 120 may be another terminal connected to the data capture device 110, or a background server that provides camera detection services. The data analysis device 120 is used to analyze the network data packet to detect whether there is a wireless camera in the local area network, and return data to the data capture device 110, and the data capture device 110 sends a defense request to the data sending device 130. The data sending device 130 is a background server connected to the data capture device 110 and the data analysis device 120 via a wireless communication link. After receiving the defense request from the data capture device 110, it will send a large number of forged MAC addresses to make the wireless camera offline from the local area network.

[0048] The following is an explanation of the hidden camera detection and protection method based on wireless network traffic in this exemplary embodiment. The application scenarios of this method include but are not limited to:

[0049] The user is in the rented room. After connecting to the local area network, the user uses the APP in the smart phone to capture network data packets, and then executes the camera detection method of this exemplary embodiment, and displays the detection results in the App; or the mobile phone captures the network data packets and uploads them to the server, and the server executes the camera detection method of this exemplary embodiment and returns the detection results to the mobile phone for display; the mobile phone issues a defense command, and another server executes the camera protection method of this exemplary embodiment.

[0050] Figure 2 An exemplary process of a camera detection and protection method is shown, which may include:

[0051] Step S210, connect the data capture device (for example, a smart phone) to the local area network to obtain wireless network data packet flow information within the spatial local area network.

[0052] Step S220, filtering non-data packets such as control packets and management packets according to the port information and IP frame header information.

[0053] Step S230, the filtered wireless network data packet flow information is grouped into data streams according to the source IP address and the destination IP address in the IP frame header information, and each group of data streams corresponds to the same type of devices connected to the local area network.

[0054] Step S240, extract the multidimensional feature vector of each group of data flows, including the proportion of source IP data packets, the average time for data packets to change target IP, the mean and standard deviation of data packet duration, the mean and standard deviation of data packet sending time interval, the mean and standard deviation of data packet length, the information entropy of the service type to which the data packet belongs, and the mean and standard deviation of the data packet survival time.

[0055] Step S250, using the multidimensional feature vector obtained in step S240 to train the XgBoost model. During training, the multidimensional feature vector corresponding to the wireless camera device is marked as a positive sample, and the multidimensional feature vectors corresponding to the remaining devices are marked as negative samples; the trained XgBoost model can realize binary classification of the data stream.

[0056] Step S260, obtain the wireless network data packet flow information in the local area network of the space to be detected, use the methods in steps S230 and S240 to extract the multi-dimensional feature vector corresponding to the data flow of all connected devices in the local area network of the detection space, and use the trained XgBoost model to determine whether there is a wireless camera in the space to be detected; if there is a wireless camera, launch a flood attack on the local area network of the space to be detected to make the wireless camera device offline.

[0057] Below Figure 2 Each step in the procedure is described in detail.

[0058] refer to Figure 2 In step S210, the wireless network data packet flow in the local area network is obtained.

[0059] The data capture device located in the local area network can capture data packets of the wireless local area network. The data capture device can realize the capture of network data packets through relevant software or settings. Take the use of Wireshark to capture network data packets of the wireless local area network as an example to obtain all data packets in the local area network. Assume that the use scenario of the present invention is that among all the data packets received by the network card, it can be determined that the data packets from the network camera are included, and the new data packets from the target network camera can be confirmed based on the public information in the data packets such as the IP address.

[0060] The captured network data packets include data packets sent by all network devices within a certain range. If there is a camera in the space to be detected, the captured network data packets also include video data packets sent by the camera. In subsequent processing, the video data packets of the camera can be identified from the network data packets and detected. Therefore, this exemplary embodiment can realize the detection of the camera when there are cameras and other network devices in the connected local area network.

[0061] In one embodiment, in order to eliminate the influence of other network devices, the user can be guided to actively shut down other known network devices connected to the local area network. For example, when the user turns on the camera detection service on the data capture device, a prompt message can be displayed to prompt the user to shut down known network devices in the space to be detected, such as a laptop, or to shut down the network connection functions of these network devices. In this way, it is ensured that the captured network data packets are mainly video data packets sent by the camera, thereby improving the efficiency of subsequent processing and the accuracy of camera detection.

[0062] After the data capture device captures the network data packet, the data analysis device can obtain the network data packet from the data capture device for subsequent processing. If the data capture device and the data analysis device are two devices, the data capture device can send the network data packet to the data analysis device through the network. If the data capture device and the data analysis device are one device, the network data packet can be sent through internal inter-process communication.

[0063] Continue to refer Figure 2 In step S240, the multi-dimensional feature vectors of each group of data flows are extracted respectively, including the source IP data packet ratio, the average time for the data packet to change the target IP, the mean and standard deviation of the data packet duration, the mean and standard deviation of the data packet sending time interval, the mean and standard deviation of the data packet length, the information entropy of the service type to which the data packet belongs, and the mean and standard deviation of the data packet survival time; the feature vector of each data flow is formed to determine whether the data flow is a wireless camera, and the specific extraction steps are as follows:

[0064] (1) Statistical data stream P = {P1, P2, ..., P i ,…,P N}, the total number of data packets (including source IP data packets and destination IP data packets) in i∈[1,N], denoted as N, P i Represents the i-th data packet in the data stream;

[0065] (2) Count the number of upstream data packets (source IP data packets) in the statistical flow, denoted as N u ;

[0066] (3) From each data packet P iExtract the packet length information from the Length field of the header i , forming a data stream packet length sequence U = {l1, l2, ..., l i , ..., l N};

[0067] (4) From each data packet P i Extract the duration d of the packet from the Duration field of the MAC frame header i , forming a data packet duration sequence G of the data stream = {d1, d2, ..., di, ..., d N};

[0068] (5) From each data packet P i Get the target IP from the five-tuple information. If the target IP changes, record the timestamp t of the data packet changing the target IP. i , forming the target IP change time sequence C of the data flow = {t1, t2, ..., t i ,...t m}, t m Indicates the timestamp of the data packet corresponding to the mth target IP in the data stream;

[0069] (6) From each data packet P i The tcpdump command obtains the packet sending timestamp and forms the packet sending time sequence S = {k1, k2, ..., ki, ..., k N};

[0070] (7) Each data packet in the data stream corresponds to a service type. i The TOS information is obtained from the header of the packet, and the frequency of each service type is marked, which is recorded as O = {f1, f2, ..., f i , ..., f w}, in this embodiment, w = 5, corresponding to the service types of 0000, 1000, 0100, 0010 and 0001, respectively, f i is the frequency of occurrence of the i-th service type.

[0071] (8) From each data packet P i The survival time (TTL) information is obtained from the header of the data packet, forming a survival time sequence H of the data stream = {tt1, tt2, ..., tt i , ..., tt N};

[0072] Using the above acquired data, the multi-dimensional feature vectors of each group of data streams are calculated respectively, specifically:

[0073] a. The proportion of source IP packets in the data flow is L:

[0074]

[0075] Among them, N u Indicates the number of source IP packets contained in the data flow, and N indicates the total number of packets contained in the data flow;

[0076] b. Get the timestamp t of the target IP address of the data packet in the data stream i , forming the target IP change time sequence C of the data flow = {t1, t2, ..., t i ,...t m}, t m Represents the timestamp of the data packet corresponding to the mth target IP in the data stream; uses the time series C to calculate the average time μ for the data packet to change the target IP in the data stream tc :

[0077] tc i =t i+1 -t i

[0078]

[0079] Among them, tc i is the time difference between the packets corresponding to the i+1th target IP and the ith target IP, μ tc It is the average time for a data packet to change its destination IP;

[0080] c. Mean value μ of packet duration d and standard deviation D d :

[0081]

[0082]

[0083] Among them, d i is the duration of the i-th data packet in the data stream;

[0084] d. The mean value of the time interval between data packet transmissions μ tk and standard deviation D tk :

[0085] tk i =k i -k i-1

[0086]

[0087]

[0088] Among them, k i is the sending time of the ith data packet in the data stream, tk i The sending time difference between the i-th data packet and the i-1-th data packet in the data stream;

[0089] e. Mean value of packet length μ l and standard deviation D l :

[0090]

[0091]

[0092] Among them, l i is the length of the i-th data packet in the data stream;

[0093] f. Each data packet in the data stream corresponds to a service type, and the frequency of each service type is calculated. i , according to the frequency f i Calculate the information entropy E(f) of the service type to which the data packet belongs:

[0094]

[0095] Where w is the number of service types, f i is the frequency of occurrence of the i-th service type;

[0096] g. Mean value μ of packet survival time tt and standard deviation D tt :

[0097]

[0098]

[0099] Among them, tt i is the lifetime of the ith data packet in the data stream.

[0100] In step S250, the eleven-dimensional feature vector obtained in step S240 is used to train the XgBoost model. During training, the wireless camera data stream is used as a positive sample and the non-wireless camera data stream is used as a negative sample to establish a binary classifier. When using the trained XgBoost model for detection, the XgBoost model is used to analyze whether there is a wireless camera data stream in the space to be detected, so as to determine whether there is a wireless camera in the space to be detected.

[0101] Specifically, when performing detection, first obtain and process the wireless network data packet traffic in the space to be detected according to the methods in steps S210 to S220, then use the method in step S240 to extract the feature vector of the data stream, and use the feature vector as the input of the trained binary classifier to obtain the detection result of whether there is a wireless camera in the space to be detected.

[0102] When a wireless camera is detected in the spatial LAN, its MAC address is obtained from the corresponding data stream of the wireless camera, and the target router information and the channel where the wireless camera transmits information are obtained based on the MAC learning mechanism of the LAN switch MAC table; a protection request is sent to the server, and after receiving the instruction, the server continuously sends a large number of forged MAC addresses to the target channel, causing the MAC table in the switch to age continuously, thereby removing the MAC address of the wireless camera from the MAC table of the switch, making it impossible for the wireless camera's information to be sent normally from the switch channel, thereby achieving the purpose of taking the wireless camera offline from the LAN.

[0103] It will be appreciated by those skilled in the art that various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which may be collectively referred to as "modules" or "systems". This application is intended to cover any variations, uses, or adaptive changes that follow the general principles of the present invention and include common knowledge or customary technical means in the art that are not disclosed in the present invention. The description and implementations are to be regarded as exemplary only, and the true scope and spirit of the present invention are indicated by the claims.

Claims

1. A method for detecting and protecting hidden cameras based on wireless network traffic, characterized in that: include: 1) Obtain wireless network data packet flow information within the spatial local area network; 2) The filtered wireless network data packet flow information is grouped into data streams according to the source IP address and the destination IP address in the IP frame header information, and each group of data streams corresponds to the same type of devices connected to the local area network; 3) Extract the multi-dimensional feature vector of each group of data flows, including the source IP packet ratio, the average time for the packet to change the target IP, the mean and standard deviation of the packet duration, the mean and standard deviation of the packet sending time interval, the mean and standard deviation of the packet length, the information entropy of the service type to which the packet belongs, and the mean and standard deviation of the packet survival time; including: Statistical data stream P = {P1, P2, ..., P i ,…,P N }, the total number of packets in i∈[1,N], denoted as N, P i Represents the i-th data packet in the data stream; Count the number of upstream data packets in the statistical flow, denoted as N u ; From each data packet P i Extract the packet length information from the Length field of the header i , forming a data stream packet length sequence U = {l1,l2,…,l i ,…,l N }; From each data packet P i Extract the duration d of the packet from the Duration field of the MAC frame header i , forming a data flow packet duration sequence G = {d1, d2, ..., d i ,…,d N }; From each data packet P i Get the target IP from the five-tuple information. If the target IP changes, record the timestamp t of the data packet changing the target IP. i , forming the target IP change time sequence C of the data flow = {t1, t2, ..., t i ,…t m }, t m Indicates the timestamp of the data packet corresponding to the mth target IP in the data stream; From each data packet P i The tcpdump command obtains the packet sending timestamp and forms the packet sending time sequence S = {k1, k2, ..., k i ,…,k N }; Each data packet in the data stream corresponds to a service type. i The TOS information is obtained from the header of the packet, and the frequency of each service type is marked, which is recorded as O = {f1, f2, ..., f i ,…,f w }, f i is the frequency of occurrence of the i-th service type; From each data packet P i The survival time information is obtained from the header of the data packet, forming the survival time sequence H of the data stream = {tt1, tt2, ..., tt i ,…,tt N }; The multidimensional feature vector described in step 3) is specifically: a. The proportion of source IP packets in the data flow is L: Among them, N u Indicates the number of source IP packets contained in the data flow, and N indicates the total number of packets contained in the data flow; b. Get the timestamp t of the target IP address of the data packet in the data stream i , forming the target IP change time sequence C of the data flow = {t1, t2, ..., t i ,…t m }, t m Represents the timestamp of the data packet corresponding to the mth target IP in the data stream; uses the time series C to calculate the average time μ for the data packet to change the target IP in the data stream tc : tc i =t i+1 -t i Among them, tc i is the time difference between the packets corresponding to the i+1th target IP and the ith target IP when changing the target IP, μ tc It is the average time for a data packet to change its destination IP; c. Mean value μ of packet duration d and standard deviation D d : Among them, d i is the duration of the i-th data packet in the data stream; d. The mean value of the time interval between data packet transmissions μ tk and standard deviation D tk : tk i =k i -k i-1 Among them, k i is the sending time of the ith data packet in the data stream, tk i The sending time difference between the i-th data packet and the i-1-th data packet in the data stream; e. Mean value of packet length μ l and standard deviation D l : Among them, l i is the length of the i-th data packet in the data stream; f. Each data packet in the data stream corresponds to a service type, and the frequency of each service type is calculated. i , according to the frequency f i Calculate the information entropy E(f) of the service type to which the data packet belongs: Where w is the number of service types, f i is the frequency of occurrence of the i-th service type; g. Mean value μ of packet survival time tt and standard deviation D tt : Among them, tt i is the lifetime of the ith data packet in the data stream; 4) Using the multidimensional feature vector obtained in step 3) to train the XgBoost model, during training, the multidimensional feature vector corresponding to the wireless camera device is marked as a positive sample, and the multidimensional feature vectors corresponding to the remaining devices are marked as negative samples; the trained XgBoost model can realize the binary classification of the data stream; 5) Obtain the wireless network data packet flow information in the local area network of the space to be detected, use the methods in steps 2) and 3) to extract the multidimensional feature vector corresponding to the data stream of all connected devices in the local area network of the detection space, input the multidimensional feature vector into the trained XgBoost model, and use the trained XgBoost model to classify the data stream into two categories to determine whether there is a wireless camera in the space to be detected; if there is a wireless camera, launch a flood attack on the local area network of the space to be detected to make the wireless camera device offline.

2. According to the method for detecting and protecting hidden cameras based on wireless network traffic in claim 1, it is characterized in that: When a wireless camera is detected in the spatial LAN, its MAC address is obtained from the corresponding data stream of the wireless camera, and the target router information and the channel where the wireless camera transmits information are obtained based on the MAC learning mechanism of the MAC table of the LAN switch; A protection request is sent to the server. After receiving the instruction, the server continuously sends a large number of forged MAC addresses to the target channel, causing the MAC table in the switch to age continuously. As a result, the MAC address of the wireless camera is removed from the MAC table of the switch, making it impossible for the information of the wireless camera to be sent normally from the switch channel, thereby achieving the purpose of taking the wireless camera offline from the LAN.

Images