Method, device, equipment and storage medium for preventing wireless network attacks

Abstract

The embodiment of the present application provides a method, apparatus, device and storage medium for preventing wireless network attacks. In the method, a terminal device receives an indication message sent by a first access point, the indication message is used to instruct the terminal device to disconnect from the first access point; determines whether the destination address indicated by the indication message is a broadcast address; if so, generates an early warning prompt. The terminal device can identify and prevent wireless network attacks, thereby improving the security of data.

Description

Technical Field

[0001] The present application belongs to the technical field of wireless local area networks, and specifically relates to a method, apparatus, device and storage medium for preventing wireless network attacks. Background Art

[0002] De-authentication Flood Attack, also known as Deauth Attack, is a form of denial of service attack on wireless networks.

[0003] Deauth attack can be that the attacker sends a fabricated false disconnection request packet to the first access point (AP). After receiving the packet, the first access point will send a packet agreeing to disconnect to the terminal devices in the entire LAN. After the connection is disconnected, the terminal devices will automatically try to reconnect with the first access point. The attacker can set a phishing access point with the same service set identifier (SSID) and password as the first access point. During the reconnection process, the terminal device may connect to the phishing access point, which may cause various privacy data on the terminal device to be stolen, resulting in low data security. Summary of the invention

[0004] The embodiments of the present application relate to a method, apparatus, device and storage medium for preventing wireless network attacks. The terminal device can identify and prevent Deauth attacks, thereby improving data security.

[0005] In a first aspect, an embodiment of the present application provides a method for preventing wireless network attacks, including:

[0006] Receiving indication information sent by the first access point, where the indication information is used to instruct the terminal device to disconnect the network connection with the first access point;

[0007] Determining whether the destination address indicated by the indication information is a broadcast address;

[0008] If so, an early warning prompt is generated.

[0009] In a possible implementation, generating an early warning prompt includes:

[0010] Acquire first characteristic information before the first access point sends the indication information;

[0011] Acquire second characteristic information after the first access point sends the indication information;

[0012] Generate a warning prompt based on the first characteristic information and the second characteristic information.

[0013] In a possible implementation manner, the first characteristic information includes a first received signal strength indication RSSI and / or a first basic service set identifier BSSID;

[0014] The second characteristic information includes a second RSSI and / or a second BSSID.

[0015] In a possible implementation manner, the first characteristic information is a first RSSI; and obtaining the first characteristic information before the first access point sends the indication information includes:

[0016] Acquire a first signal sent by the first access point, where the sending time of the first signal is earlier than the sending time of the indication information;

[0017] The first signal is measured to obtain a first RSSI.

[0018] In a possible implementation, generating a warning prompt according to the first characteristic information and the second characteristic information includes:

[0019] Determining whether the first characteristic information is the same as the second characteristic information;

[0020] If yes, obtaining the number of reconnections between the terminal device and the first access point, and generating a warning prompt according to the number of reconnections;

[0021] If not, when the terminal device reconnects to the first access point, the reconnection is canceled and an early warning prompt is generated.

[0022] In a possible implementation manner, the first characteristic information is a first RSSI, and the second characteristic information is a second RSSI; and determining whether the first characteristic information is the same as the second characteristic information includes:

[0023] Determine a difference between the first RSSI and the second RSSI;

[0024] If the difference is greater than or equal to the first preset threshold, it is determined that the first RSSI is different from the second RSSI;

[0025] If the difference is less than the first preset threshold, it is determined that the first RSSI is the same as the second RSSI.

[0026] In a possible implementation, generating a warning prompt according to the number of reconnections includes:

[0027] Determine whether the number of reconnections is greater than a second preset threshold;

[0028] If so, when the terminal device reconnects to the first access point, the reconnection is canceled and an early warning prompt is generated.

[0029] In a second aspect, an embodiment of the present application provides a device for preventing wireless network attacks, including a receiving module, a judging module and a generating module, wherein:

[0030] The receiving module is used to receive the indication information sent by the first access point, where the indication information is used to instruct the terminal device to disconnect the network connection with the first access point;

[0031] The judging module is used to judge whether the destination address indicated by the indication information is a broadcast address;

[0032] The generating module is used to, if so, generate an early warning prompt.

[0033] In a third aspect, an embodiment of the present application provides an electronic device, including: a processor and a memory;

[0034] Memory stores computer-executable instructions;

[0035] The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method of the first aspect.

[0036] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method of the first aspect.

[0037] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the method of the first aspect when executed by a processor.

[0038] In a sixth aspect, an embodiment of the present application provides a chip having a computer program stored thereon, and when the computer program is executed by the chip, the method of the first aspect is implemented.

[0039] In a possible implementation manner, the chip is a chip in a chip module.

[0040] The embodiment of the present application provides a method, apparatus, device and storage medium for preventing wireless network attacks. In the method, a terminal device receives an indication message sent by a first access point, the indication message is used to instruct the terminal device to disconnect from the first access point; determines whether the destination address indicated by the indication message is a broadcast address; if so, generates an early warning prompt. The terminal device can identify and prevent Deauth attacks, thereby improving the security of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0042] Figure 2 A flowchart of a method for preventing wireless network attacks provided in an embodiment of the present application;

[0043] Figure 3 A schematic diagram of displaying a warning prompt provided in an embodiment of the present application;

[0044] Figure 4 A flowchart of another method for preventing wireless network attacks provided in an embodiment of the present application;

[0045] Figure 5 A flowchart of another method for preventing wireless network attacks provided in an embodiment of the present application;

[0046] Figure 6 A schematic diagram of the structure of a device for preventing wireless network attacks provided in an embodiment of the present application;

[0047] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] It should be noted that, although the terms "first", "second", etc. are used to describe various information in the embodiments of the present application, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. Optionally, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information.

[0050] It should be understood that the terms "comprises" and "includes" indicate the presence of the previously mentioned features, steps, operations, but do not exclude the presence, occurrence or addition of one or at least one other feature, step, operation. The terms "and / or" and the like used in this application may be interpreted as inclusive, or mean any one or any combination. Optionally, "A and / or B" means "any of the following: A; B; A and B". In addition, the character " / " in this article generally indicates that the objects associated before and after are in an "or" relationship.

[0051] For ease of understanding, the following Figure 1 , the application scenarios to which the embodiments of the present application are applicable are described.

[0052] Figure 1 This is a schematic diagram of an application scenario provided by the embodiment of this application. Figure 1 , including a first access point 101 and a terminal device 102. After the terminal device 102 establishes a connection with the first access point 101, data can be transmitted.

[0053] In the related art, the Deauth attacker can use the broadcast address as the source address to send a fabricated data packet requesting to disconnect to the first access point. After receiving the data packet, the first access point will return a data packet agreeing to disconnect to the broadcast address, so that all terminal devices in the entire local area network receive the data packet agreeing to disconnect. When the connection between the terminal device and the first access point is disconnected, the terminal device will automatically try to reconnect to the first access point. During the reconnection process, the following problems will occur:

[0054] 1. The attacker can capture the handshake data packet between the first access point and the terminal device during reconnection, thereby stealing the password of the first access point;

[0055] 2. After stealing the password, the attacker can set up a phishing access point with the same SSID and password as the first access point. When reconnecting, the terminal device may connect to the phishing access point, resulting in the theft of various private data on the terminal device.

[0056] In order to avoid the above technical problems, an embodiment of the present application provides a method for preventing wireless network attacks. After receiving the indication information instructing to disconnect, the terminal device can identify and prevent Deauth attacks by whether the destination address indicated by the indication information is a broadcast address, thereby improving data security.

[0057] The technical solution shown in the present application is described in detail below through specific embodiments. It should be noted that the following embodiments can exist independently or in combination with each other, and the same or similar contents will not be described repeatedly in different embodiments.

[0058] Figure 2 A flowchart of a method for preventing wireless network attacks provided in an embodiment of the present application. Figure 2 , the method comprising:

[0059] S201: Receive indication information sent by a first access point.

[0060] The execution subject of the embodiment of the present application can be a terminal device such as a mobile phone, a smart watch, a smart screen, or a device for preventing wireless network attacks set in the terminal device. The device for preventing wireless network attacks can be implemented by software or by a combination of software and hardware.

[0061] The indication information may be used to instruct the terminal device to disconnect from the network with the first access point.

[0062] The indication information may be carried in a management data packet.

[0063] The network connection between the terminal device and the first access point may be a Wireless Fidelity (WIFI) connection.

[0064] S202: Determine whether the destination address indicated by the indication information is a broadcast address.

[0065] If yes, execute S203;

[0066] If not, the wireless network attack prevention process ends and the normal disconnection process begins.

[0067] The destination address indicated by the indication information may be the destination address to which the first access point sends the indication information.

[0068] A broadcast address can be an address specifically used to send messages to all workstations in the network at the same time.

[0069] In a network using the Transmission Control Protocol (TCP) / Internet Protocol (IP) protocol, an IP address whose Host Identity Document (host ID) segment is all 1s is a broadcast address, and broadcast packets are sent to all computers involved in the host ID segment. For example, for the 10.1.1.0 (255.255.255.0) network segment, its broadcast address is 10.1.1.255 (255 is 11111111 in binary), and when a packet with a destination address of 10.1.1.255 is sent, it will be distributed to all computers on the network segment.

[0070] If the destination address of the indication information sent by the first access point is the IP address of a terminal device, rather than a broadcast address, it can be determined that the disconnection operation indicated by the indication information is a normal disconnection operation.

[0071] S203: Generate an early warning prompt.

[0072] like Figure 3 As shown, the terminal device can display a prompt interface and display a warning prompt in the prompt interface.

[0073] The warning prompt may be to remind the user that the current WIFI network may be attacked by Deauth, so please check the network, etc.

[0074] After checking the network, the user can end the wireless network attack prevention process and enter the wireless network attack prevention process again after receiving the instruction information next time.

[0075] exist Figure 2 In the embodiment shown, the terminal device receives the indication information sent by the first access point, the indication information is used to instruct the terminal device to disconnect the network connection with the first access point; determines whether the destination address indicated by the indication information is a broadcast address; if so, generates an early warning prompt. The terminal device can identify and prevent Deauth attacks by whether the destination address indicated by the indication information is a broadcast address, thereby improving data security.

[0076] exist Figure 2 Based on the embodiment shown, the terminal device can determine whether the first access point that sends the indication information is under a Deauth attack according to whether the destination address is a broadcast address. If the destination address is a broadcast address, it can be determined that the first access point is under a Deauth attack. In order to improve the accuracy of identifying Deauth attacks, further judgment can be made after determining that the destination address is a broadcast address. Figure 4 Describe in detail the process of preventing wireless network attacks on terminal devices.

[0077] Figure 4 A flowchart of another method for preventing wireless network attacks provided in an embodiment of the present application. Figure 4 , the method comprising:

[0078] S401: Receive indication information sent by a first access point.

[0079] It should be noted that the execution process of S401 can refer to the execution process of S201, and will not be repeated here.

[0080] S402: Determine whether the destination address indicated by the indication information is a broadcast address.

[0081] If yes, execute S403.

[0082] If not, execute S405 to enter the normal disconnection process.

[0083] If the destination address is a broadcast address, it can be determined that the first access point is suspected to be under a Deauth attack. In order to determine whether the first access point is under a Deauth attack, S403 can be executed.

[0084] S403: Acquire first characteristic information before the first access point sends the indication information and second characteristic information after the first access point sends the indication information.

[0085] The first characteristic information and the second characteristic information may be the same or different.

[0086] After the terminal device establishes a connection with the first access point, the first characteristic information of the first access point can be obtained.

[0087] After receiving the indication information indicating disconnection, the terminal device will disconnect from the first access point and automatically enter the reconnection process. After reconnection, the second characteristic information of the first access point can be obtained again.

[0088] The first characteristic information may include a first received signal strength indicator (Received Signal Strength Indicator, RSSI) and / or a first basic service set identifier (Basic Service Set Identity Document, BSSID).

[0089] The second characteristic information may include a second RSSI and / or a second BSSID.

[0090] The first RSSI and the second RSSI may be the same or different.

[0091] The first BSSID and the second BSSID may be the same or different.

[0092] The first RSSI can be obtained by:

[0093] A first signal sent by a first access point is acquired, where the sending time of the first signal is earlier than the sending time of the indication information; and the first signal is measured to obtain a first RSSI.

[0094] The method for obtaining the second RSSI can refer to the first RSSI, which will not be repeated here.

[0095] S404: Generate a warning prompt based on the first characteristic information and the second characteristic information.

[0096] After receiving the indication information indicating the disconnection, the terminal device will disconnect from the first access point and automatically enter the reconnection process. At this time, if the first access point sends the indication information due to a Deauth attack, the terminal device may reconnect to a phishing access point with the same SSID and password as the first access point. However, the terminal device does not know that it is reconnecting to a phishing access point. At this time, the terminal device can obtain the second feature information of the "first access point" again. If the first feature information is different from the first feature information, it can be determined that the first access point has been attacked by Deauth.

[0097] S405: End the wireless network attack prevention process.

[0098] After receiving the warning prompt, the user can check the network to ensure the security of the data, and then end the wireless network attack prevention process and enter the wireless network attack prevention process again after receiving the instruction information next time.

[0099] exist Figure 4 In the illustrated embodiment, the terminal device receives the indication information sent by the first access point, the indication information is used to instruct the terminal device to disconnect the network connection with the first access point; determines whether the destination address indicated by the indication information is a broadcast address; if so, obtains the first characteristic information before the first access point sends the indication information and the second characteristic information after the first access point sends the indication information, and generates an early warning prompt based on the first characteristic information and the second characteristic information. The terminal device can determine whether the first access point is suspected of being attacked by Deauth by whether the destination address indicated by the indication information is a broadcast address, and further determines that the first access point is attacked by Deauth based on the first characteristic information and the second characteristic information. The terminal device can correctly identify and prevent Deauth attacks, thereby improving data security.

[0100] Based on any of the above embodiments, Figure 5 The process of preventing wireless network attacks in this application is described in detail.

[0101] Figure 5 A flowchart of another method for preventing wireless network attacks provided in an embodiment of the present application. Figure 5 , the method comprising:

[0102] S501: Receive indication information sent by a first access point.

[0103] It should be noted that the execution process of S501 can refer to the execution process of S201, which will not be described in detail here.

[0104] S502: Determine whether the destination address indicated by the indication information is a broadcast address.

[0105] If yes, execute S503.

[0106] If not, execute S508 to enter the normal disconnection process.

[0107] S503: Acquire first characteristic information before the first access point sends the indication information and second characteristic information after the first access point sends the indication information.

[0108] It should be noted that the execution process of S503 can refer to the execution process of S403, which will not be described in detail here.

[0109] S504: Determine whether the first characteristic information is the same as the second characteristic information.

[0110] If yes, execute S505.

[0111] If not, execute S507.

[0112] If the first characteristic information is the first RSSI and the second characteristic information is the second RSSI, it can be determined whether the first RSSI and the second RSSI are the same in the following manner:

[0113] Determine the difference between the first RSSI and the second RSSI; if the difference is greater than or equal to the first preset threshold, determine that the first RSSI is different from the second RSSI; if the difference is less than the first preset threshold, determine that the first RSSI is the same as the second RSSI.

[0114] The difference may be an absolute value.

[0115] The first preset threshold can be determined based on actual conditions and is not limited in this application.

[0116] If the first characteristic information is the first RSSI and the second characteristic information is the second RSSI, then the difference between the first characteristic information and the second characteristic information may mean that the difference between the first RSSI and the second RSSI is greater than or equal to the first preset threshold; the sameness of the first characteristic information and the second characteristic information may mean that the difference between the first RSSI and the second RSSI is less than the first preset threshold.

[0117] If the first characteristic information is the first BSSID and the second characteristic information is the second BSSID, then the first characteristic information being different from the second characteristic information may mean that the first BSSID is different from the second BSSID; the first characteristic information being the same as the second characteristic information may mean that the first BSSID is the same as the second BSSID.

[0118] If the first characteristic information includes a first RSSI and a first BSSID, and the second characteristic information includes a second RSSI and a second BSSID, then the difference between the first characteristic information and the second characteristic information may mean that the difference between the first RSSI and the second RSSI is greater than or equal to the first preset threshold and / or the first BSSID is different from the second BSSID; the sameness of the first characteristic information and the second characteristic information may mean that the difference between the first RSSI and the second RSSI is less than the first preset threshold and the first BSSID is the same as the second BSSID.

[0119] S505: Obtain the number of reconnections between the terminal device and the first access point.

[0120] If the terminal device and the first access point are disconnected, they will automatically try to reconnect, and if the reconnection fails, the reconnection will be triggered again. The number of reconnection times may refer to the number of times the terminal device sends a connection request to the first access point after the disconnection.

[0121] The terminal device may generate an early warning prompt according to the number of reconnection times, which may be implemented by executing S506 and subsequent steps.

[0122] S506: Determine whether the number of reconnection times is greater than a second preset threshold.

[0123] If yes, execute S507.

[0124] If not, execute S508.

[0125] The second preset threshold can be determined based on actual conditions and is not limited in this application.

[0126] Exemplarily, the second preset threshold may be 2.

[0127] The purpose of limiting the number of reconnection times is to prevent the data packets sent during the reconnection process from being intercepted by other terminal devices, thereby improving data security.

[0128] S507: When the terminal device reconnects to the first access point, cancel the reconnection and generate an early warning prompt.

[0129] Canceling reconnection is to improve data security.

[0130] For generating a warning prompt, please refer to S203, which will not be described in detail here.

[0131] S508: End the wireless network attack prevention process.

[0132] It should be noted that the execution process of S508 can refer to the execution process of S405, which will not be described in detail here.

[0133] exist Figure 5 In the illustrated embodiment, the terminal device receives the indication information sent by the first access point, the indication information is used to instruct the terminal device to disconnect the network connection with the first access point; determines whether the destination address indicated by the indication information is a broadcast address; if so, obtains the first characteristic information before the first access point sends the indication information and the second characteristic information after the first access point sends the indication information, determines whether the first characteristic information and the second characteristic information are the same, and if so, obtains the number of reconnections between the terminal device and the first access point; if the number of reconnections is greater than the second preset threshold, when the terminal device reconnects with the first access point, cancels the reconnection and generates an early warning prompt; if the first characteristic information and the second characteristic information are different, when the terminal device reconnects with the first access point, cancels the reconnection and generates an early warning prompt. The terminal device can correctly identify and prevent Deauth attacks, thereby improving data security.

[0134] Figure 6 A schematic diagram of a device for preventing wireless network attacks provided in an embodiment of the present application. Figure 6 The device 10 includes a receiving module 11, a judging module 12 and a generating module 13, wherein:

[0135] The receiving module 11 is used to receive indication information sent by the first access point, where the indication information is used to instruct the terminal device to disconnect the network connection with the first access point;

[0136] The judging module 12 is used to determine whether the destination address indicated by the indication information is a broadcast address;

[0137] The generating module 13 is used to, if yes, generate an early warning prompt.

[0138] In a possible implementation, the generation module 13 includes a first acquisition submodule, a second acquisition submodule and a generation submodule, wherein:

[0139] The first acquisition submodule is used to acquire the first characteristic information before the first access point sends the indication information;

[0140] The second acquisition submodule is used to acquire the second characteristic information after the first access point sends the indication information;

[0141] The generation submodule is used to generate a warning prompt based on the first characteristic information and the second characteristic information.

[0142] In a possible implementation manner, the first characteristic information includes a first received signal strength indication RSSI and / or a first basic service set identifier BSSID;

[0143] The second characteristic information includes a second RSSI and / or a second BSSID.

[0144] In a possible implementation manner, the first characteristic information is a first RSSI; and the first acquisition submodule is specifically configured to:

[0145] Acquire a first signal sent by the first access point, where the sending time of the first signal is earlier than the sending time of the indication information;

[0146] The first signal is measured to obtain a first RSSI.

[0147] In a possible implementation, the generation submodule includes a judgment unit and a generation unit, wherein:

[0148] The judging unit is used to judge whether the first characteristic information is the same as the second characteristic information;

[0149] The generating unit is used to, if yes, obtain the number of reconnections between the terminal device and the first access point, and generate a warning prompt according to the number of reconnections; if no, cancel the reconnection when the terminal device reconnects to the first access point, and generate a warning prompt.

[0150] In a possible implementation manner, the first characteristic information is a first RSSI, and the second characteristic information is a second RSSI; the judging unit is specifically configured to:

[0151] Determine a difference between the first RSSI and the second RSSI;

[0152] If the difference is greater than or equal to the first preset threshold, it is determined that the first RSSI is different from the second RSSI;

[0153] If the difference is less than the first preset threshold, it is determined that the first RSSI is the same as the second RSSI.

[0154] In a possible implementation manner, the generating unit is specifically configured to:

[0155] Determine whether the number of reconnections is greater than a second preset threshold;

[0156] If so, when the terminal device reconnects to the first access point, the reconnection is canceled and an early warning prompt is generated.

[0157] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 , the electronic device 20 may include: a transceiver 21, a memory 22, and a processor 23. The transceiver 21 may include: a transmitter and / or a receiver. The transmitter may also be referred to as a transmitter, a transmitter, a transmission port, a transmission interface, or similar descriptions, and the receiver may also be referred to as a receiver, a reception port, a reception interface, or similar descriptions. Exemplarily, the transceiver 21, the memory 22, and the processor 23 are interconnected via a bus 24.

[0158] The memory 22 is used to store program instructions;

[0159] The processor 23 is used to execute the program instructions stored in the memory, so as to enable the electronic device 20 to execute any of the above-mentioned methods for preventing wireless network attacks.

[0160] The transceiver 21 is used to perform the transceiver function of the electronic device 20 in the method for preventing wireless network attacks.

[0161] The electronic device 20 may be a chip, a module, an integrated development environment (IDE), etc.

[0162] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the above-mentioned method for preventing wireless network attacks.

[0163] The embodiment of the present application also provides a computer program product, which can be executed by a processor. When the computer program product is executed, any of the above-mentioned methods for preventing wireless network attacks can be implemented.

[0164] The device, electronic device, computer-readable storage medium and computer program product for preventing wireless network attacks in the embodiments of the present application can execute the technical solutions shown in the above-mentioned communication method embodiments. Their implementation principles and beneficial effects are similar and will not be repeated here.

[0165] All or part of the steps of the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned memory (storage medium) includes: read-only memory (ROM), random access memory (RAM), flash memory, hard disk, solid state drive, magnetic tape, floppy disk, optical disc and any combination thereof.

[0166] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0167] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0168] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0169] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for preventing wireless network attacks, characterized in that: include: Receiving indication information sent by the first access point, where the indication information is used to instruct the terminal device to disconnect the network connection with the first access point; Determining whether the destination address indicated by the indication information is a broadcast address; If so, an early warning prompt is generated; Generate early warning alerts, including: Acquire first characteristic information before the first access point sends the indication information, where the first characteristic information is acquired after the terminal device establishes a connection with the first access point; Acquire second characteristic information after the first access point sends the indication information, where the second characteristic information is acquired again after the terminal device disconnects from the first access point after receiving the indication information and automatically reconnects; generating the warning prompt according to the first characteristic information and the second characteristic information; The first characteristic information and the second characteristic information generate the early warning prompt; including: Determining whether the first characteristic information is the same as the second characteristic information; If yes, obtaining the number of reconnections between the terminal device and the first access point, and generating the early warning prompt according to the number of reconnections; If not, when the terminal device reconnects to the first access point, canceling the reconnection and generating the warning prompt; Generating the warning prompt according to the number of reconnections; including: Determining whether the number of reconnections is greater than a second preset threshold; If so, when the terminal device reconnects to the first access point, the reconnection is canceled and the early warning prompt is generated.

2. The method according to claim 1, characterized in that The first characteristic information includes a first received signal strength indication RSSI, and / or a first basic service set identifier BSSID; The second characteristic information includes a second RSSI and / or a second BSSID.

3. The method according to claim 2, characterized in that The first characteristic information is the first RSSI; acquiring the first characteristic information before the first access point sends the indication information includes: Acquire a first signal sent by the first access point, where the sending time of the first signal is earlier than the sending time of the indication information; The first signal is measured to obtain the first RSSI.

4. The method according to claim 1, characterized in that The first characteristic information is a first RSSI, and the second characteristic information is a second RSSI; and determining whether the first characteristic information is the same as the second characteristic information includes: Determine a difference between the first RSSI and the second RSSI; If the difference is greater than or equal to a first preset threshold, determining that the first RSSI is different from the second RSSI; If the difference is smaller than the first preset threshold, it is determined that the first RSSI is the same as the second RSSI.

5. A device for preventing wireless network attacks, characterized in that: It includes a receiving module, a judging module and a generating module, wherein: The receiving module is used to receive indication information sent by the first access point, where the indication information is used to instruct the terminal device to disconnect the network connection with the first access point; The judging module is used to determine whether the destination address indicated by the indication information is a broadcast address; The generating module is used to, if yes, generate an early warning prompt; The generation module is specifically used for: Acquire first characteristic information before the first access point sends the indication information, where the first characteristic information is acquired after the terminal device establishes a connection with the first access point; Acquire second characteristic information after the first access point sends the indication information, where the second characteristic information is acquired again after the terminal device disconnects from the first access point after receiving the indication information and automatically reconnects; generating the warning prompt according to the first characteristic information and the second characteristic information; The generation module includes a first acquisition submodule, a second acquisition submodule and a generation submodule; The generation submodule includes a judgment unit and a generation unit, wherein: The judging unit is used to judge whether the first characteristic information is the same as the second characteristic information; The generating unit is used to, if yes, obtain the number of reconnections between the terminal device and the first access point, and generate a warning prompt according to the number of reconnections; if no, cancel the reconnection when the terminal device reconnects to the first access point, and generate a warning prompt; When the first characteristic information is the same as the second characteristic information, the generating unit is specifically configured to: Determine whether the number of reconnections is greater than a second preset threshold; If so, when the terminal device reconnects to the first access point, the reconnection is canceled and an early warning prompt is generated.

6. An electronic device, characterized in that: include: Processor, memory; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 4 when executed by a processor.

8. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 4 when being executed by a processor.

Images