Imitation Attack Detection Method, Device, Equipment and Medium Based on Channel Characteristics

Abstract

The present invention discloses a method, apparatus, device and medium for detecting imitation attacks based on channel characteristics. The method comprises: collecting the true values of the channel characteristics of a wireless device during operation for a period of time and constructing a detection vector sequence; inputting the detection vector sequence into a pre-trained deep learning model to obtain the channel characteristic prediction value at the corresponding moment; constructing a channel characteristic deviation sequence based on the deviation between the true value of the channel characteristic and the predicted value of the channel characteristic; processing the channel characteristic deviation sequence to obtain a smoothed deviation sequence; calculating a dynamic threshold based on the smoothed deviation sequence, and detecting the moment of imitation attack based on the dynamic threshold. The predicted value of the present invention includes the time correlation of the channel characteristic time series, reducing the noise interference caused by the movement of the device; detecting the moment of attack in an unsupervised manner based on the dynamic threshold, efficiently detecting imitation attacks in the wireless network system, improving the accuracy and robustness of the detection, and increasing the security of the wireless network.

Description

Technical Field

[0001] The present invention relates to the technical field of physical layer attack detection, and in particular to a method, device, equipment and medium for detecting imitation attacks based on channel characteristics. Background Art

[0002] The widespread use of electronic devices has greatly facilitated people's daily lives. However, various cyberattacks threaten the security of users. One of the most serious threats is caused by insiders who abuse their privileges for malicious purposes.

[0003] A major category of internal threats comes from impersonation attacks. Impersonation attacks refer to attacks in which an attacking device impersonates a legitimate device by mimicking the data link layer address or other legitimate authentication information of a legitimate device, thereby disguising itself as a legitimate device to access the wireless network, thereby stealing information or issuing erroneous instructions.

[0004] The detection of impersonation attacks has been a long-standing research topic. Early approaches primarily focused on detecting attacks above the network layer, or even at the application layer. These methods primarily analyze the sequence of commands and system calls executed by the user. Researchers use call sites, call stacks, system call parameter information, and captured sequence relationships to detect attackers. Specific algorithms used include those based on information theory, text mining, and naive Bayes. A key issue with these methods is their high computing power requirements, making them difficult to implement in practice due to the limited computing resources of many terminal devices.

[0005] Recent advances in wireless network security have focused on leveraging the unique channel characteristics between transmitting and receiving devices for authentication. Received signal strength, a typical channel characteristic, is closely related to device location. When a transmitting device is in different locations, received signal strength varies, making it difficult for attackers to simulate its value. Extensive research has been conducted to detect impersonation attacks by analyzing variations in received signal strength. In 2008, Anish et al. published "Spatial Signatures for Lightweight Security in Wireless Sensor Networks" using spatial features based on received signal strength to detect and localize attacks. However, their method's robustness and detection rate were unsatisfactory when subjected to noise interference or when devices were close together. In 2010, Chen et al. published "Detecting and localizing identity-based attacks in wireless and sensor networks" and presented numerous theoretical results on attack detection based on received signal strength. Using statistical significance tests, they proposed a general attack detection model and derived a mathematical relationship between received signal strength distance in signal space and node distance in physical space.

[0006] With the rapid development of machine learning technology, incorporating machine learning methods into attack detection has become a new trend. Machine learning methods include supervised and unsupervised approaches. Supervised methods require a large amount of reliable pre-labeled data as a training set, which is difficult to obtain in practice. Furthermore, it is difficult to include all attack types in the training set, which leads to poor performance of supervised models when encountering unknown attacks. Due to the limitations of supervised methods, unsupervised methods are increasingly being adopted. In 2010, Chen et al. proposed a general attack detection model in "Detecting and localizing identity-based attacks in wireless and sensor networks" by leveraging the spatial correlation of received signal strength (RSS) at wireless nodes. The model uses the K-means algorithm to derive a test statistic, which is robust against attackers using different transmission power levels. They also proposed analytical expressions for the accuracy, detection rate, and false positive rate of determining whether two devices are co-located based on the distance between RSS in signal space. In 2017, Nguyen et al. applied an unsupervised method, a first-class support vector machine, to attack detection in "WiLAD: Wireless Localization through Anomaly Detection." They assumed that legitimate devices are safe within a relatively fixed location range and used a first-class support vector machine to learn the received signal strength within this safe range. If the device's received signal strength is detected outside the safe area, an attack is considered to have occurred. Since safe areas are typically much smaller than unsafe areas, this method only requires data from safe areas, without the need for labeling, significantly reducing the cost of collecting training data.

[0007] When an attacking device transmits signals on behalf of a legitimate device, sudden changes in its location and channel environment can lead to sudden changes in the received signal strength. Detecting these changes can detect the attacking device. Traditional supervised methods require large, labeled datasets, which are difficult to obtain, and cannot effectively address attack types not present in the training data. Unsupervised methods, currently primarily based on clustering algorithms, typically only learn that values within a specific range are normal. This is suitable for fixed transmitter locations, but performance degrades significantly when the transmitter is mobile. Summary of the Invention

[0008] Purpose of the invention: In response to the defects in the prior art, the present invention provides a method, device, equipment and medium for detecting imitation attacks based on channel characteristics, which solves the problem that in the existing imitation attack detection process, when the legitimate device is in a mobile state or multiple locations, the fluctuation of channel characteristics affects the accuracy and robustness of the detection results.

[0009] Technical solution: To achieve the above technical objectives, the present invention adopts the following technical solution: a method for detecting imitation attacks based on channel characteristics, comprising the following steps:

[0010] Collecting the true channel characteristic values of the wireless device over a period of time and constructing a detection vector sequence, inputting the detection vector sequence into a pre-trained deep learning model to obtain the channel characteristic prediction value at the corresponding time, and constructing a channel characteristic deviation sequence based on the deviation between the true channel characteristic value and the predicted channel characteristic value;

[0011] Processing the channel characteristic deviation sequence to obtain a smoothed deviation sequence;

[0012] A dynamic threshold is calculated according to the smoothed deviation sequence, and a moment of imitation attack is detected according to the dynamic threshold.

[0013] Furthermore, the training process of the pre-trained deep learning model includes:

[0014] Collecting historical data of real values of channel characteristics when the wireless device is operating normally, wherein the historical data of real values of channel characteristics includes historical data of real values of channel characteristics when the wireless device is in different motion states and different positions;

[0015] For the historical data of the true value of the channel characteristics at each moment, the historical data of the true value of the channel characteristics in the time window before the moment is extracted to construct a training vector sequence;

[0016] The training vector sequence is used as the input of the deep learning model, and the deep learning model outputs the predicted value of the channel feature at that moment. The true value of the channel feature at that moment in the historical data of the true value of the channel feature is used as the label, and the pre-trained deep learning model is obtained through training.

[0017] Furthermore, the channel characteristic deviation sequence is processed to obtain a smoothed deviation sequence, including:

[0018] Performing distance penalty processing on the channel characteristic deviation sequence to obtain a channel characteristic fluctuation sequence;

[0019] The channel characteristic fluctuation sequence is smoothed to obtain a smoothed deviation sequence.

[0020] Furthermore, performing distance penalty processing on the channel characteristic deviation sequence to obtain a channel characteristic fluctuation sequence includes:

[0021] For the deviation at each moment in the channel characteristic deviation sequence, extract the deviation of a distance penalty window before the moment from the channel characteristic deviation sequence to construct a distance penalty window set;

[0022] Calculating, for each deviation in the distance penalty window set, an average degree of fluctuation corresponding to the deviation at that moment;

[0023] The average fluctuation degree at all moments in the channel characteristic deviation sequence constitutes a channel characteristic fluctuation sequence.

[0024] Furthermore, the calculation formula for the average fluctuation degree at each moment in the channel characteristic deviation sequence is:

[0025]

[0026] Among them, d t for e t The average volatility, e t is the deviation at time t in the channel characteristic deviation sequence, w d is the distance penalty window length, d tj for e t Relative to e j The relative volatility, e j is the deviation at time j in the distance penalty window, tw d ≤j≤t-1.

[0027] Furthermore, the e t Relative to e j The relative volatility d tj The calculation formula is:

[0028] If e t and e j Same number:

[0029] d tj =|e t -e j | / [1+α(w d -t+j)]

[0030] If e t and e j Other name:

[0031] d tj =|e t -e j | / [β+α(w d -t+j)]

[0032] Among them, α and β are distance penalty coefficients.

[0033] Furthermore, calculating a dynamic threshold based on the smoothed deviation sequence and detecting the moment of imitation attack based on the dynamic threshold include:

[0034] constructing a startup data set based on a number of data at the start time in the smoothed deviation sequence, calculating an initial threshold value based on the startup data set, calculating a first comparison value for each data in the startup data set, screening all the first comparison values based on the initial threshold value, and constructing an initial local data sequence;

[0035] Calculating a dynamic threshold based on the last local data sequence, calculating a second comparison value for each data item in the smoothed deviation sequence other than the starting data set in chronological order, and comparing the second comparison values of all data items with the dynamic threshold value in turn. When the second comparison values of all data items are less than the dynamic threshold value, it is determined that the corresponding time has not been subjected to an imitation attack, and the data item is added to the last local data sequence, and the earliest value added in the last local data sequence is deleted. The updated last local data sequence serves as the current local data sequence;

[0036] Otherwise, the corresponding moment is determined to be under imitation attack, and this moment is the attack point. The previous local data sequence is directly used as the current local data sequence;

[0037] Continue to detect the next data until all data except the starting data set in the smoothed deviation sequence are traversed, and all moments judged as attack points are output.

[0038] A device for detecting imitation attacks based on channel characteristics, comprising:

[0039] A channel characteristic deviation sequence construction module is used to collect the actual channel characteristic values of the wireless device during a period of operation and construct a detection vector sequence, input the detection vector sequence into a pre-trained deep learning model to obtain the channel characteristic prediction value at the corresponding time, and construct a channel characteristic deviation sequence based on the deviation between the actual channel characteristic value and the predicted channel characteristic value;

[0040] a smoothing module, configured to process the channel characteristic deviation sequence to obtain a smoothed deviation sequence;

[0041] The imitation attack detection module is used to calculate a dynamic threshold based on the smoothed deviation sequence and detect the moment of imitation attack based on the dynamic threshold.

[0042] A device includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the device implements any one of the aforementioned methods for detecting imitation attacks based on channel characteristics.

[0043] A computer-readable storage medium stores computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, are used to implement any one of the aforementioned methods for detecting imitation attacks based on channel characteristics.

[0044] Beneficial Effects: The present invention collects the actual channel characteristics of wireless devices over a period of time and constructs a detection vector sequence. The detection vector sequence is input into a pre-trained deep learning model to obtain the channel characteristic prediction value at the corresponding moment, and then constructs a channel characteristic deviation sequence. The predicted value includes the time correlation of the channel characteristic time series, reducing the noise interference caused by the device movement.

[0045] By smoothing the channel characteristic deviation sequence to obtain a smoothed deviation sequence, the false alarm caused by normal channel characteristic fluctuations when the device is moving is reduced, thereby reducing noise interference;

[0046] A dynamic threshold is calculated using the smoothed deviation sequence, and the moment of imitation attack is detected based on the dynamic threshold. The present invention can unsupervisedly detect the moment of attack based on the dynamic threshold, efficiently detecting imitation attacks in wireless network systems, improving detection accuracy and robustness, and enhancing wireless network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a flow chart of a method for detecting imitation attacks according to an embodiment of the present invention;

[0048] Figure 2 is a schematic diagram of the method of Example 1;

[0049] Figure 3 is a training flow chart of the deep learning model of Example 1;

[0050] Figure 4 is a flow chart of the distance penalty algorithm of Example 1;

[0051] Figure 5 is a flow chart of the customized dynamic threshold algorithm of Example 1;

[0052] Figure 6 This is a partial schematic diagram of the received signal strength sequence of the legitimate device B in Example 2;

[0053] Figure 7 Yes Figure 6 Schematic diagram of the received signal strength deviation sequence E after processing;

[0054] Figure 8 Yes Figure 7 Schematic diagram of the processed and smoothed deviation sequence S;

[0055] Figure 9 It is a schematic diagram of the device structure of the present invention. DETAILED DESCRIPTION

[0056] The following further describes and explains the channel feature-based imitation attack detection method, device, equipment, and medium of the present invention in conjunction with the accompanying drawings and embodiments.

[0057] Example 1:

[0058] This method identifies impersonation attacks by detecting changes in the channel characteristics between the sender and receiver. Common channel characteristics include received signal strength and channel state information. Due to its availability, this embodiment uses received signal strength as the channel characteristic.

[0059] Based on a deep learning algorithm, this approach uses the channel characteristic of the physical layer's received signal strength to detect changes in the device's received signal strength. This method establishes the following overall attack detection framework: real-time acquisition of received signal strength; prediction using a model to determine the deviation between the predicted and true values; addressing this deviation using a distance penalty algorithm and a smoothing algorithm; and finally, using an unsupervised dynamic thresholding method to determine a dynamic threshold. The resulting deviation is then compared with the threshold for judgment.

[0060] This embodiment discloses a method for detecting imitation attacks based on channel characteristics, which is mainly used to detect imitation attacks during wireless device communication and to subsequently prevent attackers from disguising themselves as legitimate devices to steal information.

[0061] As attached Figure 1 and attached Figure 2 As shown, a method for detecting imitation attacks based on channel characteristics in this embodiment specifically includes the following steps:

[0062] Step 1: Collect the actual channel characteristic values of the wireless device over a period of time and construct a detection vector sequence, input the detection vector sequence into a pre-trained deep learning model to obtain the corresponding channel characteristic prediction values at several moments, and construct a channel characteristic deviation sequence, wherein the channel characteristic deviation sequence includes the deviations between the actual channel characteristic values and the channel characteristic prediction values at several moments;

[0063] As attached Figure 3 As shown in Figure 2, the deep learning model pre-training process includes:

[0064] Collecting historical data of real values of channel characteristics when the wireless device is operating normally, wherein the historical data of real values of channel characteristics includes historical data of real values of channel characteristics when the wireless device is in different motion states and different positions;

[0065] For the historical data of the true value of the channel characteristics at each moment, the historical data of the true value of the channel characteristics in the time window before the moment is extracted to construct a training vector sequence. The training vector sequence is used as the input of the deep learning model. The deep learning model outputs the predicted value of the channel characteristics at that moment. The true value of the channel characteristics at that moment in the historical data of the true value of the channel characteristics is used as the label. The deep learning model with optimized parameters is trained to complete the pre-training of the deep learning model.

[0066] The present invention is applicable to all wireless devices participating in communication in a network, such as wireless devices participating in communication under the Zigbee network protocol. For wireless devices in the network, the received signal strength (RSS) of the wireless devices during normal operation is collected at a receiving device used for identity authentication at fixed time intervals. When collecting data, the received signal strength of the device should be collected when it is in various possible motion states, such as static, moving, position change, etc. The collected data is a time series of received signal strength {x1, x2, ..., x N}, where N is the sequence length. For the received signal strength x at time i i , 1≤i≤N, take the value within the previous time window to form the training vector X i :

[0067] X i =(x i-W ,...,x i-1 ) (1)

[0068] Where W is the length of the time window.

[0069] The time series of received signal strength {x1, x2, ..., x N By transforming formula (1), we get the training vector sequence X:

[0070] X={X1,X2,...,X N} (2)

[0071] Taking the training vector sequence X as input, this embodiment uses the existing deep learning model of the recurrent convolutional network to predict the received signal strength value at each moment. The predicted value is The label is the true value x at the current moment i , a deep learning model with optimal parameters is obtained by training, that is, a pre-trained deep learning model is obtained. It should be noted that the present invention does not limit the specific network form of the deep learning model.

[0072] This embodiment uses a recurrent convolutional network to learn the time series changes in received signal strength, including changes in different motion states and locations of the wireless device in the time domain. This embodiment collects historical data of the actual channel characteristics of the wireless device during normal operation. This historical data includes historical data of the actual channel characteristics of the wireless device in different motion states and locations.

[0073] For the time series of received signal strength, a vector sequence is constructed through its values in the previous time window range, and then the corresponding received signal strength prediction value is obtained by using a recurrent convolutional network. The prediction value includes the time correlation of the time series of received signal strength, which solves the problem that existing methods cannot cope with legitimate devices in a mobile state or multiple locations, reduces the interference of mobile state noise, and thus enhances the robustness of detection against imitation attacks.

[0074] In this embodiment, the received signal strength is used as the channel feature. Therefore, the channel feature deviation sequence hereinafter refers to the received signal strength deviation sequence, the channel feature true value refers to the received signal strength true value, and the channel feature predicted value refers to the received signal strength predicted value.

[0075] After pre-training, a deep learning model with the best prediction effect on the received signal strength of wireless devices was obtained. During the detection process, the time series {x1, x2, ..., x t}, t represents time t, which is the current time in this embodiment.

[0076] For each value in the time series of the received signal strength, the value in the previous time window is taken to construct a detection vector. All detection vectors are combined to form a detection vector sequence. The detection vector sequence is input into the pre-trained deep learning model to output the corresponding received signal strength prediction value; the received signal strength x at the current moment is used as the t For example, the received signal strength prediction value output by the deep learning model is The deviation between the actual value of the channel characteristic at the current moment and the predicted value of the channel characteristic, that is, the deviation between the actual value of the received signal strength and the predicted value is e t , and its calculation formula is:

[0077]

[0078] The channel characteristic deviation sequence, i.e., the received signal strength deviation sequence E, is constructed from the deviations between the actual channel characteristic values and the predicted channel characteristic values at all times from 1 to t.

[0079] In the present invention, when calculating the received signal strength deviation sequence E, the data of the previous time window is predicted through the model for the received signal strength at each moment to obtain the corresponding received signal strength prediction value, and then the received signal strength deviation sequence E is obtained. While considering the timing characteristics of the data, the limitation of the time window avoids the long-term dependence of the time series, solves the problem that the channel characteristic fluctuation affects the accuracy and robustness of the detection result, makes the final detection result robust, and improves the detection accuracy.

[0080] Step 2: Process the channel characteristic deviation sequence to obtain a smoothed deviation sequence; in the present invention, due to the influence of factors such as noise, obstacles, and movement of wireless devices, the received signal strength of the wireless device will still fluctuate during normal operation. Smoothing processing can effectively reduce the false alarms caused by these factors and reduce noise interference.

[0081] The processing of the channel characteristic deviation sequence to obtain a smoothed deviation sequence includes:

[0082] Performing distance penalty processing on the channel characteristic deviation sequence to obtain a channel characteristic fluctuation sequence;

[0083] The channel characteristic fluctuation sequence is smoothed to obtain a smoothed deviation sequence.

[0084] Specifically,

[0085] The distance penalty algorithm proposed in the present invention is used to process the channel characteristic deviation sequence to obtain the channel characteristic fluctuation sequence; specifically, the method includes:

[0086] For the deviation et at each moment in the channel characteristic deviation sequence, the deviation of the distance penalty window before the moment is extracted from the channel characteristic deviation sequence, and a distance penalty window set is constructed. For each deviation in the distance penalty window set, the average fluctuation degree corresponding to the deviation at the moment is calculated. The average fluctuation degree of all moments in the channel characteristic deviation sequence constitutes the channel characteristic fluctuation sequence.

[0087] As attached Figure 4 Specifically, a distance penalty algorithm is used to process the channel characteristic deviation sequence to obtain a channel characteristic fluctuation sequence, including the steps of:

[0088] Step 2.1: For the received signal strength deviation sequence E obtained in step 1:

[0089] E={e1,e2,...,e t} (4)

[0090] Construct a distance penalty window set for the deviation corresponding to each moment in the received signal strength deviation sequence, with the current moment e tFor example, get the current time value e t The value in the previous distance penalty window where w d is the distance penalty window length. It should be noted that the first w in the received signal strength deviation sequence d The distance penalty window set cannot be obtained at the wd+1th moment, so when constructing the distance penalty window set, the calculation starts from the wd+1th moment.

[0091] Step 2.2: For each deviation corresponding to a moment in the received signal strength deviation sequence, calculate the relative fluctuation of each value in the distance penalty window set relative to the deviation at that moment;

[0092] Taking the current moment et as an example, each value e in its distance penalty window j ,(tw d )≤j≤t-1, calculate e t Relative to e j The relative volatility d tj , d tj According to e t and e j Discussion on the case of same number but different numbers, if the number is the same:

[0093] d tj =|e t -e j | / [1+α(w d -t+j)] (5)

[0094] If the sign is different:

[0095] d tj =|e t -e j | / [β+α(w d -t+j)] (6)

[0096] Among them, α and β are distance penalty coefficients, which are preset values and are selected according to actual conditions.

[0097] Step 2.3: For each value in the distance penalty window set, calculate the average fluctuation degree corresponding to the deviation at that moment according to its relative fluctuation degree;

[0098] With the current e t For example, according to step 2.2, calculate the value of e for each value in the distance penalty window t The relative fluctuation degree of the deviation e t The average volatility d t , and its calculation formula is:

[0099]

[0100] The average fluctuation degree is calculated for each value in the distance penalty window set to form a channel characteristic fluctuation sequence, that is, the received signal strength fluctuation sequence D.

[0101] The present invention adopts the newly proposed distance penalty algorithm to measure the average fluctuation degree of the current time t, and sets a smaller weight for the deviation close to the time t when calculating the relative fluctuation degree, that is, in formula (5) or formula (6), the closer j is to t, the larger j is, and the larger the denominator in formula (5) or formula (6) is, the reciprocal of which is taken as e j The smaller the corresponding weight, the better the calculation of the average fluctuation degree can combine the influence of each value in the window, rather than being completely affected by the deviation closer to the current moment.

[0102] The advantages of the distance penalty algorithm proposed in the present invention include: 1. The influence of the previous value on the current value is appropriately reduced through weight control. When the wireless device is moving, there will be a certain difference between the current value and the previous value, which may lead to false alarms. The distance penalty algorithm proposed in the present invention allows a comprehensive comparison of the current value and the value in the previous window to obtain an average fluctuation degree, thereby reducing false alarms; 2. When the movement direction of the wireless device changes, even a small movement amplitude will cause a significant change. The distance penalty algorithm proposed in the present invention reduces the impact of this change by setting a smaller weight for this situation.

[0103] The smoothing algorithm is used to process the channel characteristic fluctuation sequence to obtain the smoothed deviation sequence, including:

[0104] For the average fluctuation degree at each moment in the channel characteristic fluctuation sequence, the average fluctuation degree of the smooth window before the moment is extracted from the channel characteristic fluctuation sequence, a smooth window set is constructed, and the fluctuation deviation between the smooth window set and the adjacent moments is calculated as the smoothed deviation. The smoothed deviations of all moments in the channel characteristic fluctuation sequence constitute a smoothed deviation sequence.

[0105] The specific steps are as follows:

[0106] Step 3.1: For the received signal strength fluctuation sequence D after the distance penalty obtained in the previous step:

[0107] D={d1,d2,...d t} (8)

[0108] Construct a smoothing window set for the average fluctuation degree corresponding to each moment in the received signal strength fluctuation sequence, and use the current moment e t For example, the average fluctuation degree d at the current moment t The values in the previous smoothing window constitute the smoothing window set where w sTo smooth the window length, it should be noted that the first w in the received signal strength fluctuation sequence s The smooth window set cannot be obtained at the moment, so when constructing the smooth window set, the smooth window set is constructed from the wth moment. s +1 moment to start counting.

[0109] Step 3.2: For the average fluctuation degree corresponding to each moment in the received signal strength fluctuation sequence, calculate the difference between the standard deviation of the smoothing window set at that moment and the previous moment, and calculate the smoothed deviation of the average fluctuation degree at that moment through the maximum value function.

[0110] With the current e t For example, for d t Calculate the smoothed deviation s t , and its calculation formula is:

[0111]

[0112] Among them, s t is the smoothed deviation of the average fluctuation level at time t, represents all the data in the smoothing window set at the current time t, Indicates all data in the smoothing window at time t-1, and σ() represents the standard deviation. In this embodiment, the standard deviation is used to calculate the discreteness of the data set. Other functions that measure the discreteness of the data set can also be used to complete the calculation, and there is no limitation here.

[0113] The average fluctuation degree of each moment in the channel characteristic fluctuation sequence is calculated according to the above method to obtain the smoothed deviation sequence S, S = {s1, s2, ..., s t}.

[0114] The present invention calculates the influence of the current moment value on the standard deviation of the previous smoothing window and uses the standard deviation to evaluate the local variation degree of the current moment value, thereby effectively reducing the influence of noise.

[0115] The present invention obtains a smoothed deviation sequence by smoothing the channel characteristic deviation sequence, thereby reducing false alarms caused by normal channel characteristic fluctuations when the device is moving, thereby reducing noise interference.

[0116] Step 3: Use the dynamic threshold algorithm proposed in the present invention to identify the moment of imitation attack in the smoothed deviation sequence and output the attack point.

[0117] A starting data set is constructed by taking the first data of the smoothed deviation sequence, an initial threshold value is calculated based on the starting data set, a first comparison value is calculated for each data in the starting data set, all first comparison values are filtered based on the initial threshold value, and an initial local data sequence is obtained;

[0118] For the data other than the starting data set in the smoothed deviation sequence, the second comparison value of each data is calculated in chronological order, and a threshold is calculated based on the previous local data sequence. All second comparison values are compared with the threshold in turn. If the value is less than the threshold, it is determined that the moment has not been subjected to an imitation attack. If the value is greater than or equal to the threshold, it is determined that the moment has been subjected to an imitation attack, and the moment is output as the attack point. The specific steps include:

[0119] Calculate the threshold based on the last local data sequence, and calculate the second comparison value for each data in the smoothed deviation sequence except the starting data set. If the second comparison value is less than the updated threshold, the data is considered normal, and the data is added to the last local data sequence. Delete the earliest value added in the last local data sequence, and use the updated last local data sequence as the current local data sequence.

[0120] If the second comparison value is greater than or equal to the updated threshold, the data is abnormal, and the moment corresponding to the data is determined to be an attack point, that is, it is under imitation attack. The previous local data sequence is directly used as the current local data sequence;

[0121] Continue to detect the next data until all data except the starting data set in the smoothed deviation sequence are traversed, and all moments judged as attack points are output.

[0122] In this embodiment, a newly proposed dynamic threshold algorithm is used to process the smoothed deviation sequence S. This custom dynamic threshold algorithm calculates and updates the threshold at each moment. A second comparison value is calculated for each moment in the smoothed deviation sequence and then compared with the updated threshold at the current moment. Points that are not less than the threshold are identified as attack points.

[0123] As attached Figure 5 As shown, the dynamic threshold algorithm proposed in the present invention is performed in the following steps:

[0124] Step 4.1: For the smoothed deviation sequence S, take the first part of the data as the starting data set S′:

[0125] S′={s′1, s′2,...,s′ n′} (10)

[0126] Where n′ is the length of the starting data set, s′ n′ is the startup data, which is the data in S.

[0127] Step 4.2: Calculate the initial threshold value thr′ based on the length n′ of the starting data set and its standard deviation σ′:

[0128]

[0129] in, The significance is equal to The critical value of the t-distribution with n′-2 degrees of freedom.

[0130] For the value s′ in the starting dataset S′ q , calculate the first comparison value G′ q :

[0131] G′ q =(s′ q -μ′) / σ′ (12)

[0132] Where μ′ is the mean of S′ and σ′ is the standard deviation of S′.

[0133] Compare G′ q and thr′, if G′ q is greater than or equal to thr′, the first comparison value G′ q s' in the corresponding startup data S' q Add to the local data sequence V. V is used as the local data sequence for obtaining the threshold.

[0134] Step 4.3: Take all the data of S after the starting data set S′ as the set S * , for S * The value in The calculation is carried out in chronological order. The specific steps include:

[0135] Step 4.3.1. Calculate the threshold thr based on the length n of the local data sequence V and its standard deviation σ as the updated threshold (i.e., calculate the dynamic threshold). The calculation formula is:

[0136]

[0137] in, The significance is equal to The critical value of the t-distribution with n-2 degrees of freedom.

[0138] Step 4.3.2: For all data of S after starting the dataset S′ Calculate the second comparison value

[0139]

[0140] Where b is the coefficient, μ is the mean of V, and σ is the standard deviation of V.

[0141] Step 4.3.3. Comparison and thr, if Less than thr, judgment value Normal. And add the current value to V Delete the earliest added value in V; as a time series data, the value range of the local data sequence will change over time. In order to adapt to this dynamic change, in this embodiment, the earliest added value in V is deleted and the value at the current moment is added.

[0142] if If it is greater than or equal to thr, the moment is considered as the attack point. No value is added to V.

[0143] Step 4.3.4, continue to detect S * The value of V at the next moment in V is obtained, and the process returns to step 4.3.1, where the mean μ of V and the standard deviation σ of V are recalculated based on the updated V.

[0144] Step 4.3.5, until S * All points in the traversal are detected and all moments judged as attack points are output.

[0145] The advantages of the dynamic threshold algorithm newly proposed in this invention include: 1. The threshold is set according to the distribution of the data, thereby achieving unsupervised detection; 2. The distribution of sequence data itself changes continuously over time, and a single threshold cannot adapt to dynamically changing data. The dynamic threshold algorithm proposed in this invention can adjust the range of local data over time, continuously update the threshold, and achieve better detection results.

[0146] This embodiment provides a complete method for detecting imitation attacks based on the received signal strength characteristics between a transmitting device and a receiving device, including three parts: predicting received signal strength, calculating deviation, applying distance penalty to the deviation, smoothing, and dynamic threshold determination. By using a recurrent convolutional network to obtain the temporal correlation of the received signal strength sequence, a distance penalty algorithm and a smoothing algorithm reduce noise interference, and a dynamic threshold algorithm makes unsupervised judgments. In traditional algorithms for detecting attacks based on received signal strength, the mobile state of a device causes the received signal strength value range to constantly change, reducing detection effectiveness. The present invention effectively addresses the obstacles that traditional algorithms face when a device is in a mobile state. The distance penalty algorithm and smoothing algorithm reduce the fluctuation of this change, while the dynamic threshold algorithm can dynamically set the threshold based on the change in the value range, improving detection accuracy and robustness. The present invention can efficiently detect imitation attacks in wireless network systems, thereby increasing wireless network security.

[0147] Example 2:

[0148] This embodiment provides a specific process of detecting a mimicry attack by applying the mimicry attack detection method based on channel characteristics proposed in the present invention during wireless device communication.

[0149] Assume that the legitimate device A and the legitimate device B communicate with each other and transmit data. The attack device C uses the identity of the legitimate device A to try to disguise itself as A to communicate with B, that is, to launch an imitation attack. At the legitimate device B, the detection method proposed by the present invention is applied. First, when A and B are communicating normally, B will always collect the received signal strength of A. According to the method in Example 1, the threshold thr corresponding to each moment can be calculated, and the threshold thr of the latest moment obtained in the calculation is always saved. When C intercepts the signal from A and disguises itself as A to establish communication with B, B will collect the received signal strength of the signal at this time and calculate it according to the method in Example 1. (obtained in step 4.3) is greater than the threshold thr saved at the latest time, then point B successfully detects that an attack device has appeared.

[0150] In this embodiment, the deep learning model set at the legitimate device B adopts the recurrent convolutional network structure proposed by Paul Werbos in "Backpropagation through time: what it does and how to do it". In addition, variational autoencoders and long short-term memory networks can also be used as deep learning models.

[0151] As attached Figure 6 The figure shows a received signal strength sequence, with the horizontal axis being the sequence number, i.e. the time, and the vertical axis being the received signal strength value. Figure 6 At the moment marked by the arrow, device C disguises itself as A and communicates with B, which is an imitation attack. Since the location of the device sending the signal changes from A to C, the received signal strength suddenly changes.

[0152] Attachment Figure 7 For attachment Figure 6 The received signal strength deviation of the received signal strength sequence calculated in step 1 of Example 1 is shown in the figure. The horizontal axis is the sequence number and the vertical axis is the deviation value. It can be seen that the deviation value at the marked attack occurrence point is significantly greater than that at other times.

[0153] Attachment Figure 8 For attachment Figure 7 The deviation sequence is the sequence calculated by the distance penalty algorithm in step 2 and the smoothing algorithm in step 3 in Example 1. The horizontal axis is the sequence number and the vertical axis is the calculated value. The value of the attack point is the second comparison value. The updated threshold value thr calculated according to step 4 in Example 1 is 2.231, and is 1.62. The value at the time of the attack is greater than the threshold value, and the algorithm is able to detect the attack.

[0154] The present invention obtains the time correlation of the receiving channel feature sequence through a pre-trained deep learning model, reduces noise interference through a distance penalty algorithm and a smoothing algorithm, and uses a newly proposed dynamic threshold algorithm to make unsupervised judgments, effectively solving the obstacles brought to traditional algorithms when the device is in a mobile state, and efficiently detecting imitation attacks in wireless network systems, thereby improving detection accuracy and increasing the security of wireless networks.

[0155] Example 3:

[0156] As attached Figure 9 As shown, this embodiment discloses a channel feature-based imitation attack detection device, including:

[0157] A channel characteristic deviation sequence construction module is used to collect the actual channel characteristic values of the wireless device during a period of operation and construct a detection vector sequence, input the detection vector sequence into a pre-trained deep learning model to obtain the channel characteristic prediction value at the corresponding time, and construct a channel characteristic deviation sequence based on the deviation between the actual channel characteristic value and the predicted channel characteristic value;

[0158] a smoothing module, configured to process the channel characteristic deviation sequence to obtain a smoothed deviation sequence;

[0159] The imitation attack detection module is used to calculate a dynamic threshold based on the smoothed deviation sequence and detect the moment of imitation attack based on the dynamic threshold.

[0160] Furthermore, the training process of the pre-trained deep learning model includes:

[0161] Collecting historical data of real values of channel characteristics when the wireless device is operating normally, wherein the historical data of real values of channel characteristics includes historical data of real values of channel characteristics when the wireless device is in different motion states and different positions;

[0162] For the historical data of the true value of the channel characteristics at each moment, the historical data of the true value of the channel characteristics in the time window before the moment is extracted to construct a training vector sequence;

[0163] The training vector sequence is used as the input of the deep learning model, and the deep learning model outputs the predicted value of the channel feature at that moment. The true value of the channel feature at that moment in the historical data of the true value of the channel feature is used as the label, and the pre-trained deep learning model is obtained through training.

[0164] Furthermore, the channel characteristic deviation sequence is processed to obtain a smoothed deviation sequence, including:

[0165] Performing distance penalty processing on the channel characteristic deviation sequence to obtain a channel characteristic fluctuation sequence;

[0166] The channel characteristic fluctuation sequence is smoothed to obtain a smoothed deviation sequence.

[0167] Furthermore, performing distance penalty processing on the channel characteristic deviation sequence to obtain a channel characteristic fluctuation sequence includes:

[0168] For the deviation at each moment in the channel characteristic deviation sequence, extract the deviation of a distance penalty window before the moment from the channel characteristic deviation sequence to construct a distance penalty window set;

[0169] Calculating, for each deviation in the distance penalty window set, an average degree of fluctuation corresponding to the deviation at that moment;

[0170] The average fluctuation degree at all moments in the channel characteristic deviation sequence constitutes a channel characteristic fluctuation sequence.

[0171] Furthermore, the calculation formula for the average fluctuation degree at each moment in the channel characteristic deviation sequence is:

[0172]

[0173] Among them, d t for e t The average volatility, e t is the deviation at time t in the channel characteristic deviation sequence, w d is the distance penalty window length, d tj for e t Relative to e j The relative volatility, e j is the deviation at time j in the distance penalty window, tw d ≤j≤t-1.

[0174] Furthermore, the e t Relative to e j The relative volatility d tj The calculation formula is:

[0175] If e t and e j Same number:

[0176] d tj =|e t -e j | / [1+α(w d -t+j)]

[0177] If e t and e j Other name:

[0178] d tj =|e t -ej | / [β+α(w d -t+j)]

[0179] Among them, α and β are distance penalty coefficients.

[0180] Furthermore, calculating a dynamic threshold based on the smoothed deviation sequence and detecting the moment of imitation attack based on the dynamic threshold include:

[0181] constructing a startup data set based on a number of data at the start time in the smoothed deviation sequence, calculating an initial threshold value based on the startup data set, calculating a first comparison value for each data in the startup data set, screening all the first comparison values based on the initial threshold value, and constructing an initial local data sequence;

[0182] Calculating a dynamic threshold based on the last local data sequence, calculating a second comparison value for each data item in the smoothed deviation sequence other than the starting data set in chronological order, and comparing the second comparison values of all data items with the dynamic threshold value in turn. When the second comparison values of all data items are less than the dynamic threshold value, it is determined that the corresponding time has not been subjected to an imitation attack, and the data item is added to the last local data sequence, and the earliest value added in the last local data sequence is deleted. The updated last local data sequence serves as the current local data sequence;

[0183] Otherwise, the corresponding moment is determined to be under imitation attack, and this moment is the attack point. The previous local data sequence is directly used as the current local data sequence;

[0184] Continue to detect the next data until all data except the starting data set in the smoothed deviation sequence are traversed, and all moments judged as attack points are output.

[0185] Example 4:

[0186] This embodiment discloses a device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements any of the above-described methods for detecting imitation attacks based on channel characteristics. The memory can be any type of memory, such as random access memory, read-only memory, or flash memory. The processor can be any type of processor, such as a central processing unit, a microprocessor, a digital signal processor, or an image processor.

[0187] A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement any of the above-described methods for detecting imitation attacks based on channel characteristics. The storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, ROM, RAM, a magnetic disk, or an optical disk.

[0188] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for detecting imitation attacks based on channel characteristics, characterized in that: The following steps are involved: Collecting the true channel characteristic values of the wireless device over a period of time and constructing a detection vector sequence, inputting the detection vector sequence into a pre-trained deep learning model to obtain the channel characteristic prediction value at the corresponding time, and constructing a channel characteristic deviation sequence based on the deviation between the true channel characteristic value and the predicted channel characteristic value; Processing the channel characteristic deviation sequence to obtain a smoothed deviation sequence; calculating a dynamic threshold based on the smoothed deviation sequence, and detecting a moment of imitation attack based on the dynamic threshold; The processing of the channel characteristic deviation sequence to obtain a smoothed deviation sequence includes: performing distance penalty processing on the channel characteristic deviation sequence to obtain a channel characteristic fluctuation sequence; and smoothing the channel characteristic fluctuation sequence to obtain a smoothed deviation sequence. The channel characteristic deviation sequence is subjected to distance penalty processing to obtain a channel characteristic fluctuation sequence, including: For the deviation at each moment in the channel characteristic deviation sequence, the deviation of the distance penalty window before the moment is extracted from the channel characteristic deviation sequence to construct a distance penalty window set; for each deviation in the distance penalty window set, the average fluctuation degree corresponding to the deviation at the moment is calculated; the average fluctuation degree of all moments in the channel characteristic deviation sequence constitutes a channel characteristic fluctuation sequence.

2. The method for detecting imitation attacks based on channel characteristics according to claim 1, characterized in that: The training process of the pre-trained deep learning model includes: Collecting historical data of real values of channel characteristics when the wireless device is operating normally, wherein the historical data of real values of channel characteristics includes historical data of real values of channel characteristics when the wireless device is in different motion states and different positions; For the historical data of the true value of the channel characteristics at each moment, the historical data of the true value of the channel characteristics in the time window before the moment is extracted to construct a training vector sequence; The training vector sequence is used as the input of the deep learning model, and the deep learning model outputs the predicted value of the channel feature at that moment. The true value of the channel feature at that moment in the historical data of the true value of the channel feature is used as the label, and the pre-trained deep learning model is obtained through training.

3. The method for detecting imitation attacks based on channel characteristics according to claim 1, wherein: The calculation formula for the average fluctuation degree at each moment in the channel characteristic deviation sequence is: Among them, d t for e t The average volatility, e t is the deviation at time t in the channel characteristic deviation sequence, w d is the distance penalty window length, d tj for e t Relative to e j The relative volatility, e j is the deviation at time j in the distance penalty window, tw d ≤j≤t-1.

4. The method for detecting imitation attacks based on channel characteristics according to claim 3, wherein: The e t Relative to e j The relative volatility d tj The calculation formula is: If e t and e j Same number: d tj =|e t -e j | / [1+α(w d -t+j)] If e t and e j Other name: d tj =|e t -e j | / [β+α(w d -t+j)] Among them, α and β are distance penalty coefficients.

5. The method for detecting imitation attacks based on channel characteristics according to claim 1, wherein: Calculating a dynamic threshold based on the smoothed deviation sequence, and detecting a moment of imitation attack based on the dynamic threshold, including: constructing a startup data set based on a number of data at the start time in the smoothed deviation sequence, calculating an initial threshold value based on the startup data set, calculating a first comparison value for each data in the startup data set, screening all the first comparison values based on the initial threshold value, and constructing an initial local data sequence; Calculate the dynamic threshold value based on the last local data sequence, and calculate the second comparison value of each data in the smoothed deviation sequence except the starting data set in chronological order; The second comparison values of all data are sequentially compared with the dynamic threshold. When the second comparison values are less than the dynamic threshold, it is determined that the corresponding moment has not been subjected to an imitation attack. The data is added to the previous local data sequence, and the earliest value added in the previous local data sequence is deleted. The updated previous local data sequence is used as the current local data sequence. Otherwise, the corresponding moment is determined to be under imitation attack, and this moment is the attack point. The previous local data sequence is directly used as the current local data sequence; Continue to detect the next data until all data except the starting data set in the smoothed deviation sequence are traversed, and all moments judged as attack points are output.

6. A device for detecting imitation attacks based on channel characteristics, characterized in that: include: A channel characteristic deviation sequence construction module is used to collect the actual channel characteristic values of the wireless device during a period of operation and construct a detection vector sequence, input the detection vector sequence into a pre-trained deep learning model to obtain the channel characteristic prediction value at the corresponding time, and construct a channel characteristic deviation sequence based on the deviation between the actual channel characteristic value and the predicted channel characteristic value; A smoothing module is used to process the channel characteristic deviation sequence to obtain a smoothed deviation sequence; wherein, processing the channel characteristic deviation sequence to obtain a smoothed deviation sequence includes: performing distance penalty processing on the channel characteristic deviation sequence to obtain a channel characteristic fluctuation sequence; smoothing the channel characteristic fluctuation sequence to obtain a smoothed deviation sequence; performing distance penalty processing on the channel characteristic deviation sequence to obtain a channel characteristic fluctuation sequence, including: for the deviation at each moment in the channel characteristic deviation sequence, extracting the deviation of a distance penalty window before the moment from the channel characteristic deviation sequence, and constructing a distance penalty window set; calculating the average fluctuation degree corresponding to the deviation at the moment for each deviation in the distance penalty window set; the average fluctuation degree of all moments in the channel characteristic deviation sequence constitutes a channel characteristic fluctuation sequence; The imitation attack detection module is used to calculate a dynamic threshold based on the smoothed deviation sequence and detect the moment of imitation attack based on the dynamic threshold.

7. A computer device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the imitation attack detection method based on channel characteristics described in any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that Computer-executable instructions are stored, and when the computer-executable instructions are executed by a processor, they are used to implement the imitation attack detection method based on channel characteristics as described in any one of claims 1 to 5.

Images