Bluetooth attack detection method, device, storage medium and mobile terminal

Abstract

The present invention discloses a Bluetooth attack detection method, device, storage medium, and mobile terminal, relating to the field of Bluetooth security technology. The method comprises: obtaining traffic data packets of a Bluetooth device group; performing keyword extraction on the traffic data packets to obtain a protocol data unit, wherein the protocol data unit includes a message type and data information; obtaining the device status of the Bluetooth device group based on the message type; and performing Bluetooth attack detection on the data information based on the device status of the Bluetooth device group to obtain an attack detection result. The present invention solves the problem in the prior art that it is difficult for users to know possible Bluetooth attack behaviors of Bluetooth devices, and achieves the purpose of detecting Bluetooth attack behaviors based on traffic data packets.

Description

Technical Field

[0001] The present invention relates to the field of Bluetooth security technology, and in particular to a Bluetooth attack detection method, device, storage medium and mobile terminal. Background Art

[0002] With the continuous development of Bluetooth technology, Bluetooth devices have an increasing number of features and diverse security requirements or modes. For example, in certain situations, Bluetooth devices must operate in a lower-security mode. In these situations, Bluetooth devices lack any security mechanisms and are vulnerable to wireless network threats and even specific Bluetooth attacks. Currently, there is no solution to detect Bluetooth devices vulnerable to specific Bluetooth attacks, making it difficult for users to identify potential attacks on their Bluetooth devices. Summary of the Invention

[0003] The main purpose of the present invention is to provide a Bluetooth attack detection method, device, storage medium and mobile terminal, aiming to solve the technical problem in the prior art that it is difficult for users to know possible Bluetooth attack behaviors of Bluetooth devices.

[0004] To achieve the above object, the present invention adopts the following technical solutions:

[0005] In a first aspect, the present invention provides a Bluetooth attack detection method, the method comprising the following steps:

[0006] Get the traffic data packets of the Bluetooth device group;

[0007] Perform keyword extraction on the traffic data message to obtain a protocol data unit, where the protocol data unit includes a message type and data information;

[0008] Obtaining the device status of the Bluetooth device group according to the message type;

[0009] Based on the device status of the Bluetooth device group, Bluetooth attack detection is performed on the data information to obtain an attack detection result.

[0010] Optionally, in the above-mentioned Bluetooth attack detection method, the Bluetooth device group includes a master device and a slave device;

[0011] When the message type is a general broadcast or an unconnectable broadcast, the device state includes that the slave device is in a broadcast state; and the step of performing Bluetooth attack detection on the data information with respect to the device state of the Bluetooth device group to obtain an attack detection result specifically includes: performing broadcast forgery attack detection on the data information to obtain an attack detection result;

[0012] When the message type is an active scan request or an active scan response, the device state includes that the master device is in a scanning state; and the step of performing Bluetooth attack detection on the data information based on the device state of the Bluetooth device group to obtain an attack detection result specifically includes: performing interference attack detection on the data information to obtain an attack detection result;

[0013] When the message type is a connection request, the device status includes that the master device and the slave device are in a connection establishment state; the step of performing Bluetooth attack detection on the data information for the device status of the Bluetooth device group to obtain an attack detection result specifically includes: performing denial of service attack detection on the data information to obtain an attack detection result.

[0014] Optionally, in the above-mentioned Bluetooth attack detection method, the step of performing broadcast forgery attack detection on the data information to obtain an attack detection result specifically includes:

[0015] When the slave device of the Bluetooth device group is in a broadcasting state, extracting a broadcast unit of the data information;

[0016] For the broadcast unit, obtaining the manufacturer-defined field of the slave device and its slave device address;

[0017] Determine whether there are multiple slave device addresses in the manufacturer-defined field;

[0018] If there are multiple slave device addresses in the manufacturer-defined field, it is determined that a broadcast forgery attack has occurred on the master device of the Bluetooth device group, and the slave device is determined to be an attack target.

[0019] Optionally, in the above-mentioned Bluetooth attack detection method, the step of performing interference attack detection on the data information to obtain an attack detection result specifically includes:

[0020] When the master device of the Bluetooth device group is in a scanning state, obtaining a data set according to the data information within a preset scanning time;

[0021] Extracting an active scan response sent by a slave device from the data set, wherein the active scan response is generated based on an active scan request sent by the master device;

[0022] Determining whether the number of active scan responses exceeds a preset number threshold;

[0023] If the number of the active scan responses exceeds a preset number threshold, it is determined that an interference attack occurs on the slave device, and the master device is determined to be an attack target.

[0024] Optionally, in the above-mentioned Bluetooth attack detection method, the step of performing denial of service attack detection on the data information to obtain an attack detection result specifically includes:

[0025] When the master device and the slave device of the Bluetooth device group are in a connection-establishing state, obtaining an address data set according to the slave device address in the data information;

[0026] Extracting a write operation data packet of the slave device address within a preset unit time from the address data set;

[0027] Determining whether the number of the write operation data packets exceeds a preset number threshold;

[0028] If the number of the write operation data packets exceeds a preset number threshold, it is determined that a denial of service attack exists on the device corresponding to the device address, and the device is determined to be an attack target.

[0029] Optionally, in the above Bluetooth attack detection method, after the step of determining whether the number of the write operation data packets exceeds a preset number threshold, the method further includes:

[0030] If the number of the write operation data packets exceeds a preset number threshold, further determining whether there is random binary data exceeding a preset data amount in the data information;

[0031] If the number of the write operation data packets exceeds a preset number threshold, it is determined that a denial of service attack exists on the slave device, and the master device is determined to be the target of the attack.

[0032] Optionally, in the Bluetooth attack detection method, after the step of performing Bluetooth attack detection on the data information based on the device status of the Bluetooth device group to obtain an attack detection result, the method further includes:

[0033] A Bluetooth attack alarm is issued according to the attack detection result.

[0034] In a second aspect, the present invention provides a Bluetooth attack detection device, the device comprising:

[0035] A data packet acquisition module is used to obtain traffic data packets of a Bluetooth device group;

[0036] An information extraction module is used to extract keywords from the traffic data message to obtain a protocol data unit, wherein the protocol data unit includes a message type and data information;

[0037] A device status acquisition module, which obtains the device status of the Bluetooth device group according to the message type;

[0038] The attack detection module performs Bluetooth attack detection on the data information according to the device status of the Bluetooth device group to obtain an attack detection result.

[0039] In a third aspect, the present invention provides a storage medium having a computer program stored thereon, wherein the computer program can be executed by one or more processors to implement the Bluetooth attack detection method as described above.

[0040] In a fourth aspect, the present invention provides a mobile terminal, comprising a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the Bluetooth attack detection method as described above is executed.

[0041] The above one or more technical solutions provided by the present invention may have the following advantages or at least achieve the following technical effects:

[0042] The present invention proposes a Bluetooth attack detection method, device, storage medium, and mobile terminal. By extracting keywords from traffic data packets of a Bluetooth device group, a protocol data unit is obtained. The device status of the Bluetooth device group is then obtained based on the message type in the protocol data unit. Bluetooth attack detection is then performed on the data information in the protocol data unit for different device states to obtain attack detection results, thereby achieving the purpose of detecting Bluetooth attack behaviors based on traffic data packets. The present invention detects multiple Bluetooth attack types and corresponding attack targets through traffic analysis, without affecting the normal use of Bluetooth devices or their existing environment. Furthermore, by performing Bluetooth attack detection for different device states, detection time can be shortened, attack detection results can be quickly obtained, and users can be informed of potential threats to Bluetooth devices in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these provided drawings without paying any creative work.

[0044] Figure 1 A schematic diagram of the hardware structure of a mobile terminal provided in an embodiment of the present invention;

[0045] Figure 2 A system architecture diagram of a communication network system provided by an embodiment of the present invention;

[0046] Figure 3 This is a flowchart of a first embodiment of a Bluetooth attack detection method according to the present invention;

[0047] Figure 4 This is a flow chart of a second embodiment of a Bluetooth attack detection method according to the present invention;

[0048] Figure 5 This is a schematic diagram comparing message types and Bluetooth attack detection in the second embodiment of the Bluetooth attack detection method of the present invention;

[0049] Figure 6 This is a flow chart of step S41 in the second embodiment of the Bluetooth attack detection method of the present invention;

[0050] Figure 7 This is a flow chart of step S42 in the second embodiment of the Bluetooth attack detection method of the present invention;

[0051] Figure 8 This is a flow chart of step S43 in the second embodiment of the Bluetooth attack detection method of the present invention;

[0052] Figure 9 Schematic diagram of the functional modules of the Bluetooth attack detection device of the present invention.

[0053] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0054] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of the present invention.

[0055] It should be noted that, in the present invention, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the statement "include..." does not exclude the presence of other identical elements in the process, method, article or system comprising the element. In addition, in the present invention, the use of suffixes such as "module", "component" or "unit" to represent elements is only for the purpose of facilitating the description of the present invention and has no specific meaning in itself. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0056] Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances. Furthermore, the technical solutions of the various embodiments may be combined with each other, but this must be based on the fact that they can be implemented by those skilled in the art. If the combination of technical solutions is mutually inconsistent or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0057] In the present invention, the terminal can be implemented in various forms. For example, it can include mobile terminals such as mobile phones, tablet computers, laptop computers, PDAs, portable media players (PMPs), navigation devices, wearable devices, smart bracelets, pedometers, etc., as well as fixed terminals such as digital TVs and desktop computers.

[0058] The following description will be made by taking a mobile terminal as an example. It will be understood by those skilled in the art that, in addition to components specifically used for mobile purposes, the configuration according to the embodiments of the present invention can also be applied to fixed type terminals.

[0059] See also Figure 1 , which is a schematic diagram of the hardware structure of a mobile terminal implementing various embodiments of the present invention, the mobile terminal 100 may include: an RF (Radio Frequency) unit 101, a WiFi module 102, an audio output unit 103, an A / V (Audio / Video) input unit 104, a sensor 105, a display unit 106, a user input unit 107, an interface unit 108, a memory 109, a processor 110, a Bluetooth module 111, and a power supply. Those skilled in the art will appreciate that Figure 1 The structure of the mobile terminal shown in the figure does not constitute a limitation to the mobile terminal. The mobile terminal may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0060] The following combination Figure 1 A detailed introduction to the various components of the mobile terminal:

[0061] The RF unit 101 can be used to send and receive information or receive signals during calls. Specifically, it receives downlink information from the base station and transmits it to the processor 110 for processing. It also transmits uplink data to the base station. Typically, the RF unit 101 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier, a duplexer, and more. Furthermore, the RF unit 101 can communicate with the network and other devices via wireless communication. The above-mentioned wireless communications may use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA2000 (Code Division Multiple Access 2000), WCDMA (Wideband Code Division Multiple Access), TD-SCDMA (Time Division-Synchronous Code Division Multiple Access), FDD-LTE (Frequency Division Duplexing-Long Term Evolution) and TDD-LTE (Time Division Duplexing-Long Term Evolution), etc.

[0062] WiFi is a short-range wireless transmission technology. Mobile terminals can help users send and receive emails, browse web pages, and access streaming media through the WiFi module 102. It provides users with wireless broadband Internet access. Figure 1 The WiFi module 102 is shown in the figure, but it is understandable that it is not an essential component of the mobile terminal and can be omitted as needed without changing the essence of the invention.

[0063] The audio output unit 103 can convert audio data received by the RF unit 101 or the WiFi module 102 or stored in the memory 109 into an audio signal and output it as sound when the mobile terminal 100 is in a call signal reception mode, a talk mode, a recording mode, a voice recognition mode, a broadcast reception mode, or the like. Furthermore, the audio output unit 103 can also provide audio output related to a specific function performed by the mobile terminal 100, such as a call signal reception sound, a message reception sound, or the like. The audio output unit 103 may include a speaker, a buzzer, or the like.

[0064] The A / V input unit 104 is used to receive audio or video signals. Specifically, the A / V input unit 104 may include a graphics processing unit (GPU) 1041 and a microphone 1042. The GPU 1041 processes image data of still images or videos captured by an image capture device (e.g., a camera) in video capture mode or image capture mode. The processed image frames may be displayed on the display unit 106. The image frames processed by the GPU 1041 may be stored in the memory 109 (or other storage medium) or transmitted via the RF unit 101 or the WiFi module 102. The microphone 1042 may receive sound (or audio data) in operating modes such as a phone call mode, a recording mode, and a voice recognition mode, and may process such sound into audio data. In the case of a phone call mode, the processed audio data may be converted into a format that can be transmitted to a mobile communication base station via the RF unit 101. The microphone 1042 may implement various types of noise cancellation (or suppression) algorithms to eliminate (or suppress) noise or interference generated during the reception and transmission of audio signals.

[0065] The mobile terminal 100 also includes at least one sensor 105, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 1061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 1061 and / or the backlight when the mobile terminal 100 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc. As for other sensors that can be configured in the mobile phone, such as fingerprint sensors, pressure sensors, iris sensors, molecular sensors, gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be repeated here.

[0066] The display unit 106 is used to display information input by the user or information provided to the user. The display unit 106 may include a display panel 1061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0067] The user input unit 107 can be used to receive input digital or character information, and generate key signal input related to user settings and function control of the mobile terminal. Specifically, the user input unit 107 may include a touch panel 1071 and other input devices 1072. The touch panel 1071, also known as a touch screen, can collect user touch operations on or near it (such as operations performed by the user using a finger, stylus, or any other suitable object or accessory on or near the touch panel 1071) and drive the corresponding connection device according to a pre-set program. The touch panel 1071 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch direction and detects the signal caused by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device and converts it into touch point coordinates, which are then sent to the processor 110. It can also receive commands sent by the processor 110 and execute them. In addition, the touch panel 1071 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 1071, the user input unit 107 may further include other input devices 1072. Specifically, the other input devices 1072 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, power keys, etc.), a trackball, a mouse, a joystick, etc., and are not specifically limited here.

[0068] Furthermore, the touch panel 1071 may cover the display panel 1061. When the touch panel 1071 detects a touch operation on or near it, it transmits the information to the processor 110 to determine the type of touch event. Subsequently, the processor 110 provides a corresponding visual output on the display panel 1061 according to the type of touch event. Figure 1 In the embodiment, the touch panel 1071 and the display panel 1061 are two independent components to realize the input and output functions of the mobile terminal. However, in some embodiments, the touch panel 1071 and the display panel 1061 can be integrated to realize the input and output functions of the mobile terminal, which is not limited here.

[0069] The interface unit 108 serves as an interface through which at least one external device can be connected to the mobile terminal 100. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 108 may be used to receive input (e.g., data information, power, etc.) from the external device and transmit the received input to one or more elements within the mobile terminal 100, or may be used to transmit data between the mobile terminal 100 and the external device.

[0070] Memory 109 can be used to store software programs and various data. Memory 109 can be a computer storage medium on which the computer program of the Bluetooth attack detection method of the present invention is stored. Memory 109 can primarily include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required for a function (such as a sound playback function, an image playback function, etc.); the data storage area can store data created based on the use of the mobile phone (such as audio data, a phone book, etc.). Furthermore, memory 109 can include high-speed random access memory and non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0071] Processor 110 is the control center of the mobile terminal, connecting various components of the mobile terminal using various interfaces and lines. By running or executing software programs and / or modules stored in memory 109 and accessing data stored in memory 109, it performs various functions of the mobile terminal and processes data, thereby monitoring the mobile terminal as a whole. For example, processor 110 executes the computer program in memory 109 to implement all or part of the steps in the Bluetooth attack detection method of the present invention. Processor 110 may include one or more processing units; optionally, processor 110 may integrate an application processor and a modem processor, wherein the application processor primarily processes the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 110.

[0072] The mobile terminal 100 may also include a Bluetooth module 111, such as a classic Bluetooth module or a low-power Bluetooth module, which is used to broadcast or scan or establish a connection with a Bluetooth module on other terminals, so that a group of terminals all including Bluetooth modules operate in the same clock and frequency hopping mode to achieve wireless data transmission.

[0073] although Figure 1 Not shown, the mobile terminal 100 may further include a power source (such as a battery) for supplying power to various components. Preferably, the power source may be logically connected to the processor 110 through a power management system, thereby enabling the power management system to manage functions such as charging, discharging, and power consumption.

[0074] To facilitate understanding of the embodiments of the present invention, the communication network system on which the mobile terminal of the present invention is based is described below.

[0075] See also Figure 2, which is a system architecture diagram of a communication network system provided in an embodiment of the present invention. The communication network system is an LTE system of universal mobile communication technology. The LTE system includes a UE (User Equipment) 201, an Evolved UMTS Terrestrial Radio Access Network (E-UTRAN) 202, an Evolved Packet Core (EPC) 203, and an operator's IP service 204, which are sequentially connected in communication.

[0076] Specifically, UE201 may be the above-mentioned terminal 100, which will not be described in detail here.

[0077] E-UTRAN 202 includes eNodeB 2021 and other eNodeBs 2022 , etc. Among them, eNodeB 2021 can be connected to other eNodeBs 2022 via a backhaul (eg, an X2 interface), and eNodeB 2021 is connected to EPC 203 , and eNodeB 2021 can provide UE 201 with access to EPC 203 .

[0078] The EPC 203 may include an MME (Mobility Management Entity) 2031, an HSS (Home Subscriber Server) 2032, other MMEs 2033, an SGW (Serving Gate Way) 2034, a PGW (PDN Gate Way) 2035, and a PCRF (Policy and Charging Rules Function) 2036. The MME 2031 is the control node that handles signaling between the UE 201 and the EPC 203, providing bearer and connection management. The HSS 2032 provides registers for managing functions such as the Home Location Register (not shown) and stores user-specific information such as service features and data rates. All user data can be sent through SGW2034, PGW2035 can provide IP address allocation and other functions for UE201, PCRF2036 is the policy and charging control policy decision point for service data flow and IP bearer resources, and it selects and provides available policy and charging control decisions for the policy and charging execution function unit (not shown in the figure).

[0079] The IP service 204 may include the Internet, an intranet, an IMS (IP Multimedia Subsystem), or other IP services.

[0080] Although the above description is based on the LTE system as an example, those skilled in the art should know that the present invention is not only applicable to the LTE system, but also to other wireless communication systems, such as GSM, CDMA2000, WCDMA, TD-SCDMA, and future new network systems, and is not limited here.

[0081] Based on the above mobile terminal hardware structure and communication network system, various embodiments of the Bluetooth attack detection method of the present invention are proposed.

[0082] Currently, Bluetooth technology is primarily divided into two types based on its applications and supported protocols: Classic Bluetooth (BT) and Bluetooth Low Energy (BLE). Classic Bluetooth generally refers to the BR (Basic Rate), EDR (Enhanced Data Rate), and AMP (Generic Alternate MAC / PHYs) technologies in Bluetooth protocols below 4.0. BLE refers to LE (Low Energy) technology that supports Bluetooth protocol 4.0 or higher. It features short range, low cost, and interoperability, and utilizes numerous intelligent methods to minimize power consumption, leading to its widespread adoption in various fields.

[0083] The Bluetooth Classic protocol specifies three basic security services: authentication, confidentiality, and authorization. Authentication verifies the identity of a communicating device based on its Bluetooth device address; Bluetooth devices do not provide local user authentication. Confidentiality prevents data leakage due to eavesdropping by ensuring only authorized devices can access and view transmitted data. Authorization ensures that a device is authorized before using a service, thus enabling resource control.

[0084] BLE differs from classic Bluetooth in its security services by introducing the AES-CCM (Advanced Encryption Standard Counter-with-cipher-block-chaining-message-authentication-code) encryption algorithm to ensure communication confidentiality, as well as the authentication and integrity of data messages. BLE also incorporates features such as private device addresses and data signatures, implemented using keys such as the IRK (Identity Resolving Key), LTK (Long Term Key), and CSRK (Connection Signature Resolving Key). These keys are generated and securely distributed during Bluetooth pairing. Therefore, BLE also offers security services such as encryption and data signatures.

[0085] In the actual application of BLE, corresponding security requirements can be configured for different service requests, thereby having different security modes or levels, as shown in Table 1:

[0086] Table 1

[0087]

[0088] As shown in Table 1, in some specific situations, Bluetooth devices must remain in the operating mode of Security Mode 1, which requires Level 1 security. In this operating mode, BLE devices and related devices do not have any security mechanisms, do not authenticate or encrypt, and directly connect for pairing. They do not provide eavesdropping protection or protection against MITM (Man-in-the-Middle Attack) attacks, and are therefore vulnerable to wireless network threats such as eavesdropping, MITM attacks, information tampering, and resource theft. They are also vulnerable to specific Bluetooth attacks such as broadcast forgery attacks, jamming attacks, and denial of service attacks.

[0089] An analysis of existing technologies has found that Bluetooth devices are vulnerable to specific Bluetooth attacks when operating in a mode with lower security requirements. However, there is currently no solution to detect Bluetooth devices that have been attacked by specific Bluetooth attacks, making it difficult for users to know about possible attack behaviors of Bluetooth devices.

[0090] In view of the technical problem in the prior art that it is difficult for users to know the possible Bluetooth attack behaviors of Bluetooth devices, the present invention provides a Bluetooth attack detection method. The overall concept is as follows:

[0091] Obtain a traffic data message of a Bluetooth device group; perform keyword extraction on the traffic data message to obtain a protocol data unit, wherein the protocol data unit includes a message type and data information; obtain a device status of the Bluetooth device group based on the message type; and perform Bluetooth attack detection on the data information based on the device status of the Bluetooth device group to obtain an attack detection result.

[0092] The above technical solution achieves the goal of detecting Bluetooth attack behaviors based on traffic data packets. Through traffic analysis, various Bluetooth attack types and corresponding attack targets are detected without affecting the normal use of Bluetooth devices or their existing environments. Furthermore, Bluetooth attack detection is performed based on different device states, shortening detection time and quickly obtaining attack detection results, allowing users to promptly identify potential threats to Bluetooth devices.

[0093] Example 1

[0094] Reference Figure 3 , is a flow chart of the first embodiment of the Bluetooth attack detection method of the present invention. This embodiment provides a first embodiment of the Bluetooth attack detection method that can be applied to a terminal, wherein the terminal can optionally Figure 1 The mobile terminal shown.

[0095] The following combination Figure 3 , the Bluetooth attack detection method provided in this embodiment is described in detail, and the method may include the following steps:

[0096] Step S10: Obtain the traffic data message of the Bluetooth device group.

[0097] Specifically, a Bluetooth device group is a group of devices that participate in broadcast communications and form a piconet. These devices include a master and slaves. The device that provides a synchronization reference is called the master, while other devices synchronize the master's clock and frequency hopping pattern. These devices are called slaves. Both the master and slave devices are Bluetooth devices, and can be Bluetooth modules using classic Bluetooth technology or Bluetooth low energy technology.

[0098] In this embodiment, a low-power Bluetooth traffic collection device is used to obtain traffic data messages between all master devices and slave devices in a Bluetooth device group in the current environment.

[0099] Step S20: extract keywords from the traffic data message to obtain a protocol data unit, where the protocol data unit includes a message type and data information.

[0100] Specifically, keyword extraction is performed on the traffic data message to extract the Protocol Data Unit (PDU) from the original hexadecimal data. The PDU includes a 16-byte header and data information (Payload), where the length of the data information is determined by the length field in the header. The 16-byte field in the header includes a 4-byte message type (PDU Type), a 2-byte reserved information (Reserved For Future Use, RFU), a 1-byte send address (TxAdd), a 1-byte receive address (RxAdd), and an 8-byte PDU length (Length).

[0101] In this embodiment, keyword extraction is performed on the traffic data message obtained in step S10 to extract the protocol data unit, and the message type and data information are obtained from the protocol data unit for use, wherein the message type may include general broadcast (ADV_IND), directed connection broadcast (ADV_DIRECT_IND), non-connectable broadcast (ADV_NONCONN_IND), active scan request (SCAN_REQ), active scan response (SCAN_RSP), connection request (CONNECT_REQ), scannable broadcast (ADV_SCAN_IND), and reserved (Reserved).

[0102] Step S30: Obtain the device status of the Bluetooth device group according to the message type.

[0103] Specifically, the protocol data unit is analyzed, and the device status of each device in the Bluetooth device group is determined based on the message type. From the perspective of the Bluetooth device group's link layer (LL), the device status of a Bluetooth device group can be in three stages: advertising (periodically sending advertising data), scanning (scanning and receiving advertising data), and initiating (issuing connection requests).

[0104] In this embodiment, when the message type is a general broadcast or an unconnectable broadcast, the device status includes the slave device being in a broadcast state; when the message type is an active scan request or an active scan response, the device status includes the master device being in a scanning state; when the message type is a connection request, the device status includes the master device and the slave device being in a connection establishment state.

[0105] Step S40: performing Bluetooth attack detection on the data information according to the device status of the Bluetooth device group to obtain an attack detection result.

[0106] Specifically, Bluetooth attacks can include broadcast forgery attacks, jamming attacks, and denial of service attacks. The following explains these three types of Bluetooth attacks:

[0107] Broadcast spoofing attack: When the Bluetooth module's beacon is in broadcast mode, it broadcasts a data packet to the surrounding area at regular intervals. As an independent Bluetooth device, the master device, performs a scanning operation and periodically receives the data packets broadcast by the beacon. This data packet contains the beacon device address, manufacturer information, and manufacturer-defined fields, which can be used to identify Bluetooth devices. Because broadcast packets do not contain authentication information, attackers can intercept the broadcast packets, modify the plaintext data, and replay them, thereby interfering with the master device's normal scanning results and affecting the user's Bluetooth device. For example, they can forge the broadcast information of a smart bracelet from a certain manufacturer to create a fake bracelet. After the master device scans the broadcast information, it will establish a connection. This makes it impossible for the user to know whether the bracelet corresponding to the connected Bluetooth device is a fake product.

[0108] Interference attack: A slave device sends broadcast data. After receiving the broadcast data, the master device can choose to send an active scan request to request the slave device to broadcast more information. Generally, Bluetooth devices will immediately respond with information within 31 bytes. An attacker can exploit this mechanism and use any programmable Bluetooth master device to send active scan requests to surrounding slave devices. All nearby slave devices in the broadcasting state will continuously respond to the active scan request and issue active scan responses. This will cause interference to the slave devices to a certain extent, such as abnormally increasing their power consumption.

[0109] Denial of Service Attack: Slave devices in broadcast mode, such as unpaired smart bracelets and smart light signs, can allow any master device to connect without proper protection. An attacker can use any Bluetooth device in master mode to repeatedly initiate connection requests, disconnecting the connection within a short period of time. For the duration of the attack, the attacked slave device remains invisible and unconnectable, causing a denial of service.

[0110] In this embodiment, for the above-mentioned Bluetooth attack types, the corresponding Bluetooth attack detection may include broadcast forgery attack detection, interference attack detection and denial of service attack detection. After step S30 determines the device status of the Bluetooth device group, corresponding Bluetooth attack detection is performed for different device states. For example, when the slave device of the Bluetooth device group is in the broadcast state, broadcast forgery attack detection is performed on the data information to obtain an attack detection result; when the master device of the Bluetooth device group is in the scanning state, interference attack detection is performed on the data information to obtain an attack detection result; when the master device and the slave device of the Bluetooth device group are in the connection establishment state, denial of service attack detection is performed on the data information to obtain an attack detection result. Among them, the attack detection result includes the detected Bluetooth attack type and the corresponding attack object, as well as the attacked object.

[0111] This embodiment provides a Bluetooth attack detection method that extracts keywords from traffic data packets of a Bluetooth device group to obtain a protocol data unit (PDU). The method then obtains the device status of the Bluetooth device group based on the message type in the PDU. Bluetooth attack detection is then performed on the data information in the PDU for different device statuses to obtain attack detection results, thereby achieving the purpose of detecting Bluetooth attack behaviors based on traffic data packets. The present invention detects multiple Bluetooth attack types and corresponding attack targets through traffic analysis, without affecting the normal use of Bluetooth devices or their existing environment. Furthermore, by performing Bluetooth attack detection for different device statuses, detection time can be shortened, attack detection results can be quickly obtained, and users can be informed of potential threats to Bluetooth devices in a timely manner.

[0112] Example 2

[0113] Based on the same invention concept, Figure 4 , is a flow chart of the second embodiment of the Bluetooth attack detection method of the present invention. This embodiment provides a second embodiment of the Bluetooth attack detection method that can be applied to a terminal based on the first embodiment. The terminal can optionally Figure 1 The mobile terminal shown.

[0114] The following combination Figure 4 , the Bluetooth attack detection method provided in this embodiment is described in detail.

[0115] Step S10: Obtain the traffic data message of the Bluetooth device group.

[0116] Specifically, the Bluetooth device group includes a master device and slave devices. For example, a BLE device in a smartwatch or smart band can act as a slave device, while a Bluetooth device with a BT module and / or BLE module built into a smartphone or computer can act as a master device. In actual use, the master device initiates a connection to the slave device.

[0117] In this embodiment, after the traffic data messages between all master devices and slave devices in the Bluetooth device group in the current environment are collected by the low-power Bluetooth traffic collection device, they are sent to the mobile terminal as input to the mobile terminal.

[0118] There is no need to change the connection status between Bluetooth device groups. Simply through traffic analysis, traffic data packets are obtained and Bluetooth attack detection is performed independently, which will not affect the normal use of Bluetooth devices and their existing environment.

[0119] Step S20: extract keywords from the traffic data message to obtain a protocol data unit, where the protocol data unit includes a message type and data information.

[0120] Specifically, message types include general broadcast, unconnectable broadcast, active scan request, active scan response, and connection request. Data information includes one or more of the following: broadcast unit (AD structure), device address, and operation data packet. Device address includes master device address and slave device address.

[0121] Keyword extraction is performed on traffic data packets, and protocol data units are extracted from the raw hexadecimal data. The message type and data information are then obtained from the protocol data units for later use. This can filter out other useless information and retain only the information required for Bluetooth attack detection. This prevents excessive traffic data and excessive data collection from occupying system space and affecting the detection process.

[0122] Step S30: Obtain the device status of the Bluetooth device group according to the message type.

[0123] Reference Figure 5 The diagram below compares message types, device states, and Bluetooth attack detection. For different message types, the device states of the Bluetooth device group include one or more of the following: the slave device is in a broadcasting state, the master device is in a scanning state, and the master and slave devices are in a connection-established state. The specific state can be set based on actual conditions.

[0124] In the first embodiment, when the message type is general broadcast or unconnectable broadcast, the device state includes the slave device being in a broadcast state. Correspondingly, S30 may include:

[0125] Step S31: When the message type is general broadcast or unconnectable broadcast, obtaining that the slave device of the Bluetooth device group is in broadcast state.

[0126] Specifically, when the message type is general broadcast or unconnectable broadcast, it means that the corresponding device is in the broadcast state. In a Bluetooth device group, the slave device is generally in the broadcast state, waiting for the master device to scan. Therefore, it can be determined that the slave device of the Bluetooth device group is in the broadcast state at this time.

[0127] In the second embodiment, when the message type is an active scan request or an active scan response, the device state includes that the master device is in a scanning state. Correspondingly, S30 may include:

[0128] Step S32: When the message type is an active scan request or an active scan response, obtaining that the master device of the Bluetooth device group is in a scanning state.

[0129] Specifically, when the message type is an active scan request or an active scan response, the active scan request generally corresponds to the master device, and the active scan response generally corresponds to the slave device, indicating that the corresponding device is in the scanning or scanned state. In a Bluetooth device group, the master device is generally in the scanning state, and forms a scanning and scanned relationship with the slave device. It can be determined that the master device of the Bluetooth device group is in the scanning state at this time.

[0130] In the third embodiment, when the message type is a connection request, the device state includes the master device and the slave device being in a connection establishment state. Correspondingly, S30 may include:

[0131] Step S33: When the message type is a connection request, it is obtained that the master device and the slave device of the Bluetooth device group are in a connection establishment state.

[0132] Specifically, when the message type is a connection request, no matter whether it is a connection request sent by the master device to the slave device or a connection request sent by the slave device to the master device, it can be determined that the master device and the slave device of the Bluetooth device group are in a connection-established state.

[0133] Step S40: performing Bluetooth attack detection on the data information according to the device status of the Bluetooth device group to obtain an attack detection result.

[0134] Specifically, the Bluetooth attacks include broadcast forgery attacks, jamming attacks, and denial of service attacks. Corresponding Bluetooth attack detection includes broadcast forgery attack detection, jamming attack detection, and denial of service attack detection. Denial of service attacks may include DoS attacks and fuzz attacks. The attack detection results include the Bluetooth attack type, the attacking target, and the attacked target.

[0135] Continue to refer to Figure 5 The control diagram shown in FIG. 4 is used to describe step S40 in detail.

[0136] Corresponding to the first embodiment of step S30, step S40 may include:

[0137] Step S41: performing broadcast forgery attack detection on the data information to obtain an attack detection result.

[0138] Specifically, it is determined whether a broadcast forgery attack occurs in the Bluetooth device group based on the acquired data information. If a broadcast forgery attack occurs, the type of the broadcast forgery attack, and the corresponding attacking object and attacked object are output.

[0139] Further, refer to Figure 6 As shown in the flowchart, step S41 may include:

[0140] Step S41.1: when the slave device of the Bluetooth device group is in the broadcasting state, extract the broadcast unit of the data information;

[0141] Step S41.2: For the broadcast unit, obtain the manufacturer-defined field of the slave device and its slave device address;

[0142] Step S41.3: Determine whether there are multiple slave device addresses in the manufacturer-defined field;

[0143] Step S41.4: If there are multiple slave device addresses in the manufacturer-defined field, it is determined that a broadcast forgery attack has occurred on the master device of the Bluetooth device group, and the slave device is determined to be the target of the attack.

[0144] Specifically, when a slave device in a Bluetooth device group is in the broadcasting state, the data portion of the broadcast packet it sends, i.e., the data information extracted in step S20, consists of multiple broadcast units. Each broadcast unit consists of a length of 1 octets and data. The data includes an AD Type and AD Data. The AD Type includes a manufacturer-defined field used to uniquely identify a device. Manufacturer-defined fields generally have two different formats: one uses the AD Type field that complies with the Bluetooth Low Energy protocol, such as some domestic manufacturers, and the other uses a completely manufacturer-defined field, such as those used by companies like Apple and Microsoft. To detect broadcast packets of both different formats while improving detection efficiency, the content of each broadcast unit is used as a feature, combined with the device address of the Bluetooth device, i.e., the slave device's device address. If multiple slave device addresses are present in a manufacturer-defined field, the slave device is determined to be a Bluetooth device forging broadcast data, thereby confirming that the master device has been subjected to a broadcast forgery attack. In this case, the slave device is the attacking target, and the master device is the victim. If multiple slave device addresses are not present in the manufacturer-defined field, the process returns to step S41.1 to continue extracting broadcast units of the data information.

[0145] In a specific implementation, after extracting the broadcast unit of the data information, the broadcast unit can be stored in the broadcast data set. Correspondingly, after extracting the broadcast unit, it can also be detected whether the broadcast unit has been stored in the broadcast data set to prevent repeated detection of the broadcast unit and waste of detection space, thereby improving the efficiency of Bluetooth attack detection.

[0146] Specifically targeting the possible broadcast forgery attack, the proposed detection solution, after obtaining the device status of the Bluetooth device group, performs corresponding Bluetooth attack detection corresponding to the possible attack behavior in the current status, which can improve detection efficiency and increase detection accuracy.

[0147] Corresponding to the second implementation of step S30, step S40 may include:

[0148] Step S42: performing interference attack detection on the data information to obtain an attack detection result.

[0149] Specifically, it is determined whether there is an interference attack on the Bluetooth device group based on the acquired data information. If there is an interference attack, the type of the interference attack, and the corresponding attacking object and attacked object are output.

[0150] Further, refer to Figure 7 As shown in the flowchart, step S42 may include:

[0151] Step S42.1: When the master device of the Bluetooth device group is in a scanning state, a data set is obtained according to the data information within a preset scanning time;

[0152] Step S42.2: Extracting active scan responses sent by the slave device from the data set, wherein the active scan responses are generated based on the active scan requests sent by the master device;

[0153] Step S42.3: Determine whether the number of active scan responses exceeds a preset number threshold;

[0154] Step S42.4: If the number of the active scan responses exceeds a preset number threshold, it is determined that the slave device has an interference attack, and the master device is determined to be the target of the attack.

[0155] Specifically, when the master device of a Bluetooth device group is in a scanning state, it sends an active scan request to a slave device. The slave device responds to the active scan request and feeds back an active scan response to the master device. However, when a slave device is surrounded by multiple master devices, the slave device responds to each master device's active scan request and feeds back an active scan response to each master device. The data of these active scan responses is included in the data information extracted in step S20. The format of the active scan response is the same as the format of the broadcast packet sent by the slave device, but the slave device does not broadcast the active scan response while in a broadcast state; it only sends an active scan response after receiving an active scan request from the master device. The active scan responses are retrieved from the data information according to a preset scan time to obtain a data set. The active scan responses sent by the slave device to a particular master device in the data set are extracted to obtain the number of active scan responses sent by the slave device to the master device. When the number of active scan responses exceeds a preset threshold, it indicates that the master device has engaged in an interference attack on the slave device. In this case, it is determined that the slave device in the Bluetooth device group is engaging in an interference attack. In this case, the master device is the attacking target and the slave device is the attacked target.

[0156] During the specific implementation process, there may be frequent data interactions. Therefore, if a slave device receives active scanning requests from multiple master devices, the master device that sends the most active scanning requests may be targeted for attack.

[0157] A normal scanning process typically takes no more than 10 seconds. To improve detection accuracy, this embodiment sets five master devices around the slave device and sets the preset scanning time to 60 seconds. Tests conducted during a 60-second normal scanning process show that the number of active scan responses sent by the slave device to each master device does not exceed 100. Therefore, this embodiment sets the preset number threshold to 100 per minute. In actual use, the preset number threshold can be adjusted based on specific circumstances.

[0158] Corresponding to the third embodiment of step S30, step S40 may include:

[0159] Step S43: performing a denial of service attack detection on the data information to obtain an attack detection result.

[0160] Specifically, based on the acquired data information, it is determined whether a denial of service attack occurs in the Bluetooth device group. If a denial of service attack occurs, the type of the denial of service attack, and the corresponding attacking object and attacked object are output.

[0161] Further, refer to Figure 8 As shown in the flowchart, step S43 may include:

[0162] Step S43.1: When the master device and the slave device of the Bluetooth device group are in a connection-established state, obtaining an address data set according to the slave device address in the data information;

[0163] Step S43.2: extracting the write operation data packet of the slave device address within a preset unit time from the address data set;

[0164] Step S43.3: Determine whether the number of the write operation data packets exceeds a preset number threshold;

[0165] Step S43.4: If the number of the write operation data packets exceeds a preset number threshold, it is determined that a denial of service attack has occurred on the slave device, and the master device is determined to be the target of the attack.

[0166] Specifically, a denial of service attack includes a DoS attack. When a master device and a slave device in a Bluetooth device group are in a connection-established state, the number of connection request packets received by the slave device in the current environment is recorded. Specifically, based on the slave device address in the data information, an address data set is obtained. Write operation packets for the slave device address within a preset unit time are extracted from the address data set. When the number of write operation packets exceeds a preset threshold, a denial of service attack is determined for the slave device, and the corresponding master device is determined to be the attacking target, and the slave device is the attacked target.

[0167] In this embodiment, a practical test experiment of continuous connection and disconnection between the master device and the slave device was conducted on the Bluetooth device group of a mobile phone and a smart wristband. The test results show that when the connection establishment and disconnection operations are performed 100 times in a row within 15 seconds, it will cause a denial of service for the smart wristband. Therefore, the preset unit time of this embodiment can be set to 15 seconds, and the corresponding preset number threshold is 100 times. When the number of write operation data packets of the smart wristband in the data information obtained within 15 seconds exceeds 100, it is determined that the smart wristband has a denial of service attack, and the mobile phone is the attacking target and the smart wristband is the attacked target.

[0168] Furthermore, the step S43 may further include:

[0169] Step S43.5: If the number of the write operation data packets exceeds the preset number threshold, further determining whether there is any random binary data exceeding the preset data amount in the data information;

[0170] Step S43.6: If the data information contains random binary data exceeding a preset data amount, it is determined that the slave device is attacked by random bad data, and the master device is determined to be the target of the attack.

[0171] Specifically, in addition to denial of service attacks, there are also random bad data attacks (Fuzz attacks) targeting Bluetooth devices. These attacks randomly write large amounts of mutated binary data to slave devices, causing them to crash and thus cause a denial of service. If the number of write packets exceeds a preset threshold and the data contains random binary data exceeding the preset amount, it indicates that the slave device is also vulnerable to a random bad data attack. In this case, the slave device is still considered the victim and the master device is the target of the attack.

[0172] Step S50: issuing a Bluetooth attack alarm according to the attack detection result.

[0173] Specifically, the monitored Bluetooth attack behavior is alarmed in real time, and the obtained Bluetooth attack type, attack target and attacked target are visually displayed to the user, so that the user can be aware of the possible Bluetooth attack behavior of the Bluetooth device in a timely manner.

[0174] This embodiment provides a Bluetooth attack detection method that performs Bluetooth attack detection on a group of Bluetooth devices that establish a connection between Bluetooth devices without adding authentication measures. In particular, it detects several situations where it is impossible to determine the authenticity of the Bluetooth device that broadcasts, the interference caused to the Bluetooth device, and the Bluetooth device is attacked by a denial of service attack. This embodiment provides a Bluetooth attack detection solution for Bluetooth near-field communication in an Internet of Things environment. It not only detects corresponding attack types for different device states and quickly detects possible Bluetooth attack behaviors with good detection effect, but also provides specific attack target and attacked target information, which is displayed to the user intuitively and clearly. When an attack occurs, an alarm is issued, which facilitates the user to take timely measures to prevent the use of Bluetooth devices from being affected.

[0175] Example 3

[0176] Based on the same invention concept, Figure 9 , is a functional module diagram of a Bluetooth attack detection device of the present invention. Based on any one of the first to second embodiments of the Bluetooth attack detection method of the present invention, this embodiment provides a Bluetooth attack detection device.

[0177] The following combination Figure 9 , a detailed description of the Bluetooth attack detection device provided in this embodiment is provided. The device may include:

[0178] A data packet acquisition module is used to obtain traffic data packets of a Bluetooth device group;

[0179] An information extraction module is used to extract keywords from the traffic data message to obtain a protocol data unit, wherein the protocol data unit includes a message type and data information;

[0180] A device status acquisition module, which obtains the device status of the Bluetooth device group according to the message type;

[0181] The attack detection module performs Bluetooth attack detection on the data information according to the device status of the Bluetooth device group to obtain an attack detection result.

[0182] Optionally, the Bluetooth device group includes a master device and a slave device;

[0183] When the message type is general broadcast or unconnectable broadcast, the device state includes that the slave device is in a broadcast state; and the attack detection module may include:

[0184] a broadcast forgery attack detection submodule, configured to perform broadcast forgery attack detection on the data information to obtain an attack detection result;

[0185] When the message type is an active scan request or an active scan response, the device status includes that the master device is in a scanning state; and the attack detection module may include:

[0186] An interference attack detection submodule, configured to perform interference attack detection on the data information to obtain an attack detection result;

[0187] When the message type is a connection request, the device state includes a state where the master device and the slave device are in a connection establishment state; and the attack detection module may include:

[0188] The denial of service attack detection submodule is used to perform denial of service attack detection on the data information to obtain an attack detection result.

[0189] Optionally, the broadcast forgery attack detection submodule may include:

[0190] An information extraction unit, configured to extract the broadcasting unit of the data information when the slave device of the Bluetooth device group is in a broadcasting state;

[0191] A manufacturer-defined field acquisition unit, configured to acquire, for the broadcast unit, the manufacturer-defined field of the slave device and its slave device address;

[0192] a broadcast forgery attack judging unit, configured to judge whether there are multiple slave device addresses in the manufacturer-defined field;

[0193] The broadcast forgery attack detection result unit is used to determine that a broadcast forgery attack exists on the master device of the Bluetooth device group and that the slave device is an attack target if there are multiple slave device addresses in the manufacturer-defined field.

[0194] Optionally, the interference attack detection submodule may include:

[0195] a data set acquiring unit, configured to acquire a data set according to the data information within a preset scanning time when the master device of the Bluetooth device group is in a scanning state;

[0196] an active scanning response acquiring unit, configured to extract an active scanning response sent by a slave device from the data set, wherein the active scanning response is generated based on an active scanning request sent by the master device;

[0197] an interference attack judgment unit, configured to judge whether the number of active scan responses exceeds a preset number threshold;

[0198] The interference attack detection result unit is used to determine that an interference attack occurs on the slave device if the number of the active scan responses exceeds a preset number threshold, and to determine that the master device that sends the most active scan requests is the target of the attack.

[0199] Optionally, the denial of service attack detection submodule may include:

[0200] an address data set acquiring unit, configured to acquire an address data set according to the slave device address in the data information when the master device and the slave device of the Bluetooth device group are in a connection-established state;

[0201] A write operation data packet acquisition unit, configured to extract the write operation data packet of the slave device address within a preset unit time from the address data set;

[0202] a denial of service attack determination unit, configured to determine whether the number of the write operation data packets exceeds a preset number threshold;

[0203] The denial of service attack detection result unit is used to determine that a denial of service attack exists on the slave device if the number of the write operation data packets exceeds a preset number threshold, and to determine that the master device is an attack target.

[0204] Optionally, the denial of service attack detection submodule may further include:

[0205] a random bad data attack judging unit, configured to further judge whether there is random binary data exceeding a preset data amount in the data information if the number of the write operation data packets exceeds a preset number threshold;

[0206] The random bad data attack detection result unit is used to determine that a random bad data attack exists on the slave device and that the master device is an attack target if random binary data exceeding a preset data amount exists in the data information.

[0207] Optionally, the device may further include:

[0208] The alarm module is used to issue a Bluetooth attack alarm according to the attack detection result.

[0209] The steps that can be implemented by each functional module of the Bluetooth attack detection device can refer to the specific descriptions in each embodiment of the Bluetooth attack detection method of the present invention, and will not be repeated here for the sake of brevity.

[0210] This embodiment provides a Bluetooth attack detection device that uses an information extraction module to perform keyword extraction on the traffic data packets of a Bluetooth device group obtained by the information extraction module to obtain a protocol data unit. The device status of the Bluetooth device group is then obtained based on the message type in the protocol data unit by the device status acquisition module. The attack detection module then performs Bluetooth attack detection on the data information in the protocol data unit for different device states to obtain attack detection results, thereby achieving the purpose of detecting Bluetooth attack behaviors based on traffic data packets. Detecting multiple Bluetooth attack types and their corresponding attack targets through traffic analysis does not affect the normal use of Bluetooth devices or their existing environment. Furthermore, performing Bluetooth attack detection for different device states can shorten detection time, quickly obtain attack detection results, and facilitate users to promptly learn of potential threats to Bluetooth devices.

[0211] Example 4

[0212] Based on the same inventive concept, on the basis of any one of the first to second embodiments of the Bluetooth attack detection method of the present invention, this embodiment provides a computer-readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, a server, an App store, etc. The storage medium stores a computer program, and when the computer program is executed by a processor, it can implement all or part of the steps of each embodiment of the Bluetooth attack detection method of the present invention.

[0213] Example 5

[0214] Based on the same inventive concept, on the basis of any one of the first to second embodiments of the Bluetooth attack detection method of the present invention, this embodiment provides a mobile terminal, such as Figure 1 shown.

[0215] The mobile terminal comprises: a memory, a processor, a communication bus, and a computer program stored in the memory;

[0216] The communication bus is used to realize the connection and communication between the processor and the memory;

[0217] The processor is configured to execute the computer program to implement all or part of the steps of each embodiment of the Bluetooth attack detection method of the present invention.

[0218] Through the description of the above embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

[0219] It should be noted that the serial numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. The above are only optional embodiments of the present invention and do not limit the patent scope of the present invention. All equivalent structures or equivalent process changes made by using the contents of the present invention specification and drawings under the inventive concept of the present invention, or directly or indirectly applied in other related technical fields, are included in the patent protection scope of the present invention.

Claims

1. A Bluetooth attack detection method, characterized in that: The method comprises the following steps: Obtaining a traffic data message of a Bluetooth device group, the Bluetooth device group including a master device and a slave device, the traffic data message being a message obtained through traffic analysis while maintaining a connection between the master device and the slave device; Perform keyword extraction on the traffic data message to obtain a protocol data unit, where the protocol data unit includes a message type and data information; According to the message type, obtaining the link layer-based device status of each device in the Bluetooth device group, the device status including broadcast status, scanning status and connection establishment status; According to the device status of the Bluetooth device group, Bluetooth attack detection is performed on the data information to obtain an attack detection result, wherein the Bluetooth attack detection includes broadcast forgery attack detection, interference attack detection and denial of service attack detection.

2. The Bluetooth attack detection method according to claim 1, wherein: When the message type is general broadcast or unconnectable broadcast, the device state includes the slave device being in a broadcast state; The step of performing Bluetooth attack detection on the data information according to the device status of the Bluetooth device group to obtain an attack detection result specifically includes: performing broadcast forgery attack detection on the data information to obtain an attack detection result; When the message type is an active scan request or an active scan response, the device state includes that the master device is in a scanning state; and the step of performing Bluetooth attack detection on the data information based on the device state of the Bluetooth device group to obtain an attack detection result specifically includes: performing interference attack detection on the data information to obtain an attack detection result; When the message type is a connection request, the device status includes that the master device and the slave device are in a connection establishment state; the step of performing Bluetooth attack detection on the data information for the device status of the Bluetooth device group to obtain an attack detection result specifically includes: performing denial of service attack detection on the data information to obtain an attack detection result.

3. The Bluetooth attack detection method according to claim 2, wherein: The step of performing broadcast forgery attack detection on the data information to obtain an attack detection result specifically includes: When the slave device of the Bluetooth device group is in a broadcasting state, extracting a broadcast unit of the data information; For the broadcast unit, obtaining the manufacturer-defined field of the slave device and its slave device address; Determine whether there are multiple slave device addresses in the manufacturer-defined field; If there are multiple slave device addresses in the manufacturer-defined field, it is determined that a broadcast forgery attack occurs on the master device of the Bluetooth device group, and the slave device is determined to be an attack target.

4. The Bluetooth attack detection method according to claim 2, wherein: The step of performing interference attack detection on the data information to obtain an attack detection result specifically includes: When the master device of the Bluetooth device group is in a scanning state, obtaining a data set according to the data information within a preset scanning time; Extracting an active scan response sent by a slave device from the data set, wherein the active scan response is generated based on an active scan request sent by the master device; Determining whether the number of active scan responses exceeds a preset number threshold; If the number of the active scan responses exceeds a preset number threshold, it is determined that an interference attack occurs on the slave device, and the master device is determined to be an attack target.

5. The Bluetooth attack detection method according to claim 2, wherein: The step of performing denial of service attack detection on the data information to obtain an attack detection result specifically includes: When the master device and the slave device of the Bluetooth device group are in a connection-establishing state, obtaining an address data set according to the slave device address in the data information; Extracting a write operation data packet of the slave device address within a preset unit time from the address data set; Determining whether the number of the write operation data packets exceeds a preset number threshold; If the number of the write operation data packets exceeds a preset number threshold, it is determined that a denial of service attack exists on the slave device, and the master device is determined to be the target of the attack.

6. The Bluetooth attack detection method according to claim 5, wherein: After the step of determining whether the number of the write operation data packets exceeds a preset number threshold, the method further includes: If the number of the write operation data packets exceeds a preset number threshold, further determining whether there is random binary data exceeding a preset data amount in the data information; If the data information contains random binary data exceeding a preset data amount, it is determined that a random bad data attack occurs on the slave device, and the master device is determined to be an attack target.

7. The Bluetooth attack detection method according to any one of claims 1 to 6, wherein: After the step of performing Bluetooth attack detection on the data information based on the device status of the Bluetooth device group to obtain an attack detection result, the method further includes: A Bluetooth attack alarm is issued according to the attack detection result.

8. A Bluetooth attack detection device, characterized in that: The device comprises: A data message acquisition module, configured to acquire traffic data messages of a Bluetooth device group, the Bluetooth device group including a master device and a slave device, the traffic data messages being messages acquired through traffic analysis while maintaining a connection between the master device and the slave device; An information extraction module is used to extract keywords from the traffic data message to obtain a protocol data unit, wherein the protocol data unit includes a message type and data information; A device status acquisition module, which obtains the link layer-based device status of each device in the Bluetooth device group according to the message type, wherein the device status includes a broadcast status, a scanning status, and a connection establishment status; The attack detection module performs Bluetooth attack detection on the data information according to the device status of the Bluetooth device group to obtain an attack detection result, wherein the Bluetooth attack detection includes broadcast forgery attack detection, interference attack detection and denial of service attack detection.

9. A storage medium having a computer program stored thereon, characterized in that: The computer program can be executed by one or more processors to implement the Bluetooth attack detection method according to any one of claims 1 to 7.

10. A mobile terminal, characterized in that: The mobile terminal includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the Bluetooth attack detection method according to any one of claims 1 to 7 is implemented.

Images