Wireless Recording Device Detection Methods and Systems

Abstract

This invention discloses a method and system for detecting recording devices based on wireless network traffic, relating to the field of information security technology. The method includes: playing a periodic audio sequence at a fixed frequency using a loudspeaker while simultaneously acquiring wireless network data packet traffic within the detection area in real time, filtering out non-data packet packets such as control packets and management packets; grouping the filtered wireless network data packet traffic into groups for wireless recording devices and non-wireless recording devices; extracting multi-dimensional features from each data stream to form a feature vector for each data stream, used to determine whether the data stream is from a wireless recording device; using the aforementioned feature vectors, training and identifying the device using machine learning, and using a binary classifier to analyze whether a wireless recording device data stream exists in the detection area, thereby determining whether a wireless recording device exists in the detection area. This invention can effectively detect recording devices with extremely high accuracy, and can protect privacy and security.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and system for detecting wireless recording devices. Background Technology

[0002] In recent years, with the rapid development of Internet and communication technologies, wireless recording devices have been used more and more widely in various industries, including education and security.

[0003] Wireless recording devices require no wiring or physical memory cards, making them highly concealed and difficult to detect. Therefore, effectively detecting the presence of wireless recording devices recording confidential information is a pressing technical challenge for the industry. Summary of the Invention

[0004] This invention provides a method and system for detecting wireless recording devices based on wireless network traffic. It uses periodic audio sequences as excitation signals to acquire wireless network data packets in the space to be detected, filters and classifies the wireless network data packets, and detects whether wireless recording devices exist in the surrounding environment. This method can effectively detect recording devices, and the detection results have extremely high accuracy. It can protect privacy and security, requires no professional equipment, and has a wide range of applications.

[0005] The technical solution adopted in this invention is as follows:

[0006] In a first aspect, the present invention provides a method for detecting a wireless recording device, comprising:

[0007] 1) Set the wireless network card to monitoring mode to obtain the wireless network data packet traffic in the space to be monitored in real time;

[0008] 2) Use a loudspeaker to play a fixed-frequency periodic audio sequence, while simultaneously using a wireless network card to capture wireless network data packet traffic in the space;

[0009] 3) Filter out non-data packets from the wireless network data packet traffic within the acquired detection space based on the FrameControl field of the MAC frame header information;

[0010] 4) The filtered wireless network data packet traffic sequence is grouped into data streams based on the source MAC address and destination MAC address in the MAC frame header information;

[0011] 5) Extract multi-dimensional features for each data stream, namely, the cosine similarity score of the relative audio sequence, the causal relationship score of the relative audio sequence, the proportion of uplink data packets in the wireless network data stream, the proportion of the maximum packet length of the uplink data packets in the wireless network data stream, and the standard deviation of the duration of the wireless network data stream. These five features form the feature vector of each data stream, which is used to determine whether the data stream is a wireless recording device.

[0012] 6) Using the above feature vectors, a random forest in machine learning is used for training and recognition. During training, the features of the wireless recording device data stream are used as positive samples and the features of the non-wireless recording device data stream are used as negative samples to build a binary classifier. During detection, the binary classifier is used to analyze whether the space to be detected contains a wireless recording device data stream, thereby determining whether the space to be detected contains a wireless recording device.

[0013] Furthermore, the method for generating the fixed-frequency periodic audio sequence in step 2) is as follows:

[0014] (1) Set the duration of the audio sequence to The playback cycle is ;

[0015] (2) For each unit of time ,in Its sound signal satisfies the following conditions:

[0016]

[0017] Here, 1 represents a sound signal per unit time, and 0 represents no sound signal per unit time. Representing the A sound signal per unit time, It is an integer;

[0018] (3) Modulate the sound signal to the ultrasonic frequency band to ensure that it is inaudible to the human ear, and obtain a periodic audio sequence. ,in, Representing the The audio signal played per unit time.

[0019] 3. The method for detecting a wireless recording device according to claim 1, characterized in that the feature vector extraction method for each data stream in step 5) is as follows:

[0020] (1) The number of data packets in the statistical stream is denoted as ;

[0021] (2) The number of uplink data packets in the statistical data stream is denoted as... ;

[0022] (3) For each data packet in the data stream ,in Extract the data packet length information from the Length field of the physical layer packet header, denoted as... Extract the duration information from the Duration field in the MAC frame header, denoted as... ;

[0023] (4) Calculate the proportion of uplink data packets in the current data stream. ;

[0024] (5) The maximum data packet length of the uplink data packets in the statistical data stream is denoted as... Calculate the cumulative distribution of uplink packet length. Then calculate the proportion of the maximum packet length of the uplink data packets in the data stream. ,in It is the number of packets with the largest packet length in the uplink data packets;

[0025] (6) Calculate the standard deviation of the duration of the current data stream. ,in It is the average duration of the total number of data packets in the data stream: ;

[0026] (7) Calculate the cosine similarity score of the data stream relative to the audio sequence. ,in The i-th data packet, For the first The audio signal played per unit time.

[0027] (8) Calculate the causal score of the data stream relative to the audio sequence. ,in For the i-th data packet, For the first The audio signal played per unit time.

[0028] Furthermore, the data stream groups mentioned in step 4) include wireless recording device groups and non-wireless recording device groups.

[0029] In a first aspect, the present invention provides a wireless recording device detection system, comprising:

[0030] The wireless network packet capture module is used to acquire wireless network packets in the space to be detected in real time.

[0031] An audio playback module, used to play periodic audio sequences at a fixed frequency;

[0032] The wireless network packet filtering module and the packet grouping module are used to filter non-data packets from the wireless network packet traffic in the space to be detected according to the Frame Control field of the MAC frame header information, and to group the filtered wireless network packet traffic sequence into data streams according to the source MAC address and destination MAC address in the MAC frame header information.

[0033] The feature extraction module is used to extract multi-dimensional features for each data stream, namely the relative audio sequence cosine similarity score, the relative audio sequence causality score, the proportion of uplink data packets in the wireless network data stream, the proportion of the maximum packet length of uplink data packets in the wireless network data stream, and the standard deviation of the duration of the wireless network data stream. These five features form the feature vector of each data stream, which is used to determine whether the data stream is from a wireless recording device.

[0034] The classification module uses the feature vectors obtained by the feature extraction module to train and identify the model using a random forest model. During training, the features of the wireless recording device data stream are used as positive samples, and the features of the non-wireless recording device data stream are used as negative samples to establish a binary classifier. During detection, the binary classifier is used to analyze whether the space to be detected contains the wireless recording device data stream, thereby determining whether the space to be detected contains the wireless recording device.

[0035] The technical solution of the present invention has the following beneficial effects:

[0036] This invention detects the presence of wireless recording devices in a target space by acquiring wireless network data packets, filtering and classifying these packets, and performing the operation. The process is simple, requiring only a smartphone to acquire the wireless network data packets. Existing wireless recording device detection schemes can only detect devices in environments with high noise levels; they cannot accurately detect devices in low-noise conditions. This invention utilizes active excitation to activate potential wireless recording devices and accurately detects them through traffic capture.

[0037] This invention significantly improves the success rate of detecting wireless recording devices compared to previous solutions. Multiple wireless recording devices were deployed in various laboratory environments. Both the previous and this solutions were tested 100 times. The previous wireless recording device detection solutions failed to detect the wireless recording devices, while the wireless recording device detection method proposed in this solution achieved a 100% success rate.

[0038] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0039] Figure 1 This diagram illustrates the system architecture of the operating environment in this exemplary embodiment.

[0040] Figure 2 A flowchart illustrating a wireless recording device detection method in this exemplary embodiment is shown. Detailed Implementation

[0041] The exemplary implementation will now be described more fully with reference to the accompanying drawings.

[0042] In the following description, numerous specific details will be provided to help those skilled in the art to fully understand the invention. The accompanying drawings are merely illustrative and not necessarily drawn to scale. Some block diagrams shown in the drawings represent functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices. The flowcharts shown in the drawings are merely illustrative and do not necessarily include all steps. For example, some steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0043] In view of the above problems, an exemplary embodiment of the present invention first provides a method for detecting a wireless recording device. Figure 1 A system architecture diagram of the operating environment for this exemplary embodiment is shown. (Reference) Figure 1 As shown, the system architecture 100 may include a data capture device 110, a data analysis device 120, and a possible wireless recording device 130. The data capture device 110 can be a device with network communication capabilities, such as a mobile phone, tablet computer, or personal computer. The data capture device 110 is located within the space to be detected and is used to capture network data packets within that space. The space to be detected includes, but is not limited to, hotel rooms, restrooms, changing rooms, and rental apartments. The data capture device 110 and the data analysis device 120 can be connected via a wired or wireless communication link, allowing the data capture device 110 to send the captured network data packets to the data analysis device 120. The data analysis device 120 can be another terminal connected to the data capture device 110, or a backend server providing wireless recording device detection services. The data analysis device 120 is used to analyze network data packets to detect the presence of wireless recording devices in the space to be detected. The wireless recording device 130 can be an illegal recording device connected to a local area network, such as a voice recorder or a recording phone.

[0044] The following describes the wireless recording device detection method according to this exemplary embodiment. Application scenarios of this method include, but are not limited to: a user in a hotel room using a mobile phone to open a wireless recording device app and capture network data packets, then executing the wireless recording device detection method of this exemplary embodiment, and displaying the detection results in the app; or the mobile phone captures network data packets and uploads them to a server, which then executes the wireless recording device detection method of this exemplary embodiment and returns the detection results to the mobile phone for display.

[0045] Figure 2 An exemplary flow of a method for detecting a wireless recording device is shown, which may include:

[0046] Step S210: Set the wireless network card to monitoring mode to obtain the wireless network data packet traffic in the space to be detected in real time.

[0047] Step S220: Play a periodic audio sequence at a fixed frequency using a loudspeaker, while simultaneously capturing wireless network data packet traffic in the space using a wireless network card;

[0048] Step S230: Filter the wireless network data packet traffic in the space to be detected by filtering control packets, management packets and other non-data packets according to the Frame Control field of the MAC frame header information; group the filtered wireless network data packet traffic sequence into data streams according to the source MAC address and destination MAC address in the MAC frame header information, including wireless recording device group and non-wireless recording device group;

[0049] Step S240: Extract multi-dimensional features from each data stream to form a feature vector for each data stream, which is used to determine whether the data stream is a wireless recording device.

[0050] Step S250: Using the above feature vectors, machine learning is used for training and recognition. A binary classifier is used to analyze whether there is a wireless recording device data stream in the space to be detected, thereby determining whether there is a wireless recording device in the space to be detected.

[0051] The following is about Figure 2 Each step in the process will be explained in detail.

[0052] refer to Figure 2 In step S210, network data packets within the space to be detected are acquired.

[0053] The data capture device located within the area to be monitored can capture network data packets, including but not limited to Wi-Fi, Bluetooth, and mobile network data packets. The capture of network data packets can be achieved through relevant software or settings on the data capture device. Taking the capture of Wi-Fi data packets as an example, setting the network card of the data capture device to promiscuous mode allows it to capture all passing network data packets, regardless of their destination address.

[0054] The captured network data packets include data packets sent by all network devices within a certain range. If a wireless recording device exists in the space to be detected, the captured network data packets also include audio data packets sent by the wireless recording device. In subsequent processing, the audio data packets of the wireless recording device can be identified and detected from the network data packets. Therefore, this exemplary embodiment can detect a wireless recording device even when a wireless recording device and other network devices exist in the space to be detected.

[0055] In one implementation, to eliminate the influence of other network devices, users can be guided to actively disable other network devices. For example, when a user enables the wireless recording device detection service on the data capture device, a prompt can be displayed, reminding the user to disable known network devices in the detection area, such as smart appliances, or to disable the network connection function of these devices. This ensures that the captured network data packets are primarily audio data packets sent by the wireless recording device, improving the efficiency of subsequent processing and the accuracy of wireless recording device detection.

[0056] After the data capture device captures network data packets, the data analysis device can retrieve these packets for subsequent processing. If the data capture device and the data analysis device are two separate devices, the data capture device can send network data packets to the data analysis device over the network. If the data capture device and the data analysis device are a single device, they can send network data packets through internal inter-process communication.

[0057] Continue to refer to Figure 2 In step S220, a periodic audio signal with a fixed frequency is played using a loudspeaker. The specific method for generating this signal is as follows:

[0058] (1) Set the duration of the audio sequence to The playback cycle is ;

[0059] (2) For each unit of time ,in Its sound signal satisfies the following conditions:

[0060]

[0061] Here, 1 represents a sound signal per unit time, and 0 represents no sound signal per unit time. Representing the A sound signal per unit time, It is an integer;

[0062] (3) Modulate the sound signal to the ultrasonic frequency band to ensure that it is inaudible to the human ear, and obtain a periodic audio sequence. ,in, Representing the The audio signal played per unit time.

[0063] 3. The method for detecting a wireless recording device according to claim 1, characterized in that the feature vector extraction method for each data stream in step 5) is as follows:

[0064] (1) The number of data packets in the statistical stream is denoted as ;

[0065] (2) The number of uplink data packets in the statistical data stream is denoted as... ;

[0066] (3) For each data packet in the data stream ,in Extract the data packet length information from the Length field of the physical layer packet header, denoted as... Extract the duration information from the Duration field in the MAC frame header, denoted as... ;

[0067] (4) Calculate the proportion of uplink data packets in the current data stream. ;

[0068] (5) The maximum data packet length of the uplink data packets in the statistical data stream is denoted as... Calculate the cumulative distribution of uplink packet length. Then calculate the proportion of the maximum packet length of the uplink data packets in the data stream. ,in It is the number of packets with the largest packet length in the uplink data packets;

[0069] (6) Calculate the standard deviation of the duration of the current data stream. ,in It is the average duration of the total number of data packets in the data stream: ;

[0070] (7) Calculate the cosine similarity score of the data stream relative to the audio sequence. ,in The i-th data packet, For the first The audio signal played per unit time.

[0071] (8) Calculate the causal score of the data stream relative to the audio sequence. ,in For the i-th data packet, For the first The audio signal played per unit time.

[0072] Continue to refer to Figure 2 In step S250, the five-dimensional features described in step S240 are used to train and identify the device using Random Forest in machine learning. During training, the features of the wireless recording device data stream are used as positive samples and the features of the non-wireless recording device data stream are used as negative samples to establish a binary classifier. During detection, the binary classifier is used to analyze whether the space to be detected contains the wireless recording device data stream, thereby determining whether the space to be detected contains the wireless recording device.

[0073] Those skilled in the art will understand that various aspects of the present invention can be implemented as a system, method, or program product.

[0074] For example, embodiments of the present invention provide a wireless recording device detection system, comprising:

[0075] The wireless network packet capture module is used to acquire wireless network packets in the space to be detected in real time.

[0076] An audio playback module, used to play periodic audio sequences at a fixed frequency;

[0077] The wireless network packet filtering module and the packet grouping module are used to filter non-data packets from the wireless network packet traffic in the space to be detected according to the Frame Control field of the MAC frame header information, and to group the filtered wireless network packet traffic sequence into data streams according to the source MAC address and destination MAC address in the MAC frame header information.

[0078] The feature extraction module is used to extract multi-dimensional features for each data stream, namely the relative audio sequence cosine similarity score, the relative audio sequence causality score, the proportion of uplink data packets in the wireless network data stream, the proportion of the maximum packet length of uplink data packets in the wireless network data stream, and the standard deviation of the duration of the wireless network data stream. These five features form the feature vector of each data stream, which is used to determine whether the data stream is from a wireless recording device.

[0079] The classification module uses the feature vectors obtained by the feature extraction module to train and identify the model using a random forest model. During training, the features of the wireless recording device data stream are used as positive samples, and the features of the non-wireless recording device data stream are used as negative samples to establish a binary classifier. During detection, the binary classifier is used to analyze whether the space to be detected contains the wireless recording device data stream, thereby determining whether the space to be detected contains the wireless recording device.

[0080] The specific implementation methods of the above modules can be referred to the method section above, and will not be repeated here. It should be noted that the division of the above modules or units is not mandatory. In fact, according to the exemplary embodiments of the present invention, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units for embodiment.

[0081] Embodiments of the system of the present invention can be applied to any device with data processing capabilities, such as a computer or other similar equipment or apparatus. The system embodiments can be implemented in software, hardware, or a combination of both.

[0082] The above-described exemplary embodiments can be implemented in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make the technical solutions disclosed in this invention more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art. The features, structures, or characteristics described in the exemplary embodiments can be combined in any suitable manner in one or more embodiments. All modifications that can be directly derived or conceived by those skilled in the art from the content disclosed in this invention should be considered within the scope of protection of this invention.

Claims

1. A method for detecting a wireless recording device, characterized in that, include: 1) Set the wireless network card to monitoring mode to obtain the wireless network data packet traffic in the space to be monitored in real time; 2) Use a loudspeaker to play a fixed-frequency periodic audio sequence, while simultaneously using a wireless network card to capture wireless network data packet traffic in the space; 3) Filter out non-data packets from the wireless network data packet traffic within the acquired detection space based on the Frame Control field of the MAC frame header information; 4) The filtered wireless network data packet traffic sequence is grouped into data streams based on the source MAC address and destination MAC address in the MAC frame header information; 5) Extract multi-dimensional features for each data stream, namely, the cosine similarity score of the relative audio sequence, the causal relationship score of the relative audio sequence, the proportion of uplink data packets in the wireless network data stream, the proportion of the maximum packet length of the uplink data packets in the wireless network data stream, and the standard deviation of the duration of the wireless network data stream. These five features form the feature vector of each data stream, which is used to determine whether the data stream is a wireless recording device. The relative audio sequence causality score is ,in For the i-th data packet, For the first The audio signal played per unit time. The duration of the audio sequence; The maximum packet length ratio of the uplink data packets in the wireless network data stream is: ,in It is the number of packets with the largest packet length in the uplink data packets. It is the number of upstream data packets in the data stream; 6) Using the above feature vectors, a random forest model is used for training and recognition. During training, the features of the wireless recording device data stream are used as positive samples and the features of the non-wireless recording device data stream are used as negative samples to establish a binary classifier. During detection, the binary classifier is used to analyze whether the space to be detected contains a wireless recording device data stream to determine whether the space to be detected contains a wireless recording device.

2. The wireless recording device detection method according to claim 1, characterized in that, The method for generating the fixed-frequency periodic audio sequence in step 2) is as follows: (1) Set the duration of the audio sequence to The playback cycle is ; (2) For each unit of time ,in Its sound signal satisfies the following conditions: ； Here, 1 represents a sound signal per unit time, and 0 represents no sound signal per unit time. Representing the A sound signal per unit time, It is an integer; (3) Modulate the sound signal to the ultrasonic frequency band to ensure that it is inaudible to the human ear, and obtain a periodic audio sequence. ,in, Representing the The audio signal played per unit time.

3. The method for detecting a wireless recording device according to claim 1, characterized in that, The feature vector extraction method for each data stream in step 5) is as follows: (1) The number of data packets in the statistical stream is denoted as ; (2) The number of uplink data packets in the statistical data stream is denoted as... ; (3) For each data packet in the data stream ,in Extract the data packet length information from the Length field of the physical layer packet header, denoted as... Extract the duration information from the Duration field in the MAC frame header, denoted as... ; (4) Calculate the proportion of uplink data packets in the current data stream. ; (5) The maximum data packet length of the uplink data packets in the statistical data stream is denoted as... Calculate the cumulative distribution of uplink packet length. Then calculate the proportion of the maximum packet length of the uplink data packets in the data stream. ,in It is the number of packets with the largest packet length in the uplink data packets; (6) Calculate the standard deviation of the duration of the current data stream. ,in It is the average duration of the total number of data packets in the data stream: ; (7) Calculate the cosine similarity score of the data stream relative to the audio sequence. ,in The i-th data packet, For the first The audio signal played per unit time; (8) Calculate the causal score of the data stream relative to the audio sequence. .

4. The method for detecting a wireless recording device according to claim 1, characterized in that, The data stream groups mentioned in step 4) include wireless recording device groups and non-wireless recording device groups.

5. A wireless recording device detection system for implementing the method of claim 1, characterized in that, include: The wireless network packet capture module is used to acquire wireless network packets in the space to be detected in real time. An audio playback module, used to play periodic audio sequences at a fixed frequency; The wireless network packet filtering module and the packet grouping module are used to filter non-data packets from the wireless network packet traffic in the space to be detected according to the Frame Control field of the MAC frame header information, and to group the filtered wireless network packet traffic sequence into data streams according to the source MAC address and destination MAC address in the MAC frame header information. The feature extraction module is used to extract multi-dimensional features for each data stream, namely the relative audio sequence cosine similarity score, the relative audio sequence causality score, the proportion of uplink data packets in the wireless network data stream, the proportion of the maximum packet length of uplink data packets in the wireless network data stream, and the standard deviation of the duration of the wireless network data stream. These five features form the feature vector of each data stream, which is used to determine whether the data stream is from a wireless recording device. The relative audio sequence causality score is ,in For the i-th data packet, For the first The audio signal played per unit time. The duration of the audio sequence; The maximum packet length ratio of the uplink data packets in the wireless network data stream is: ,in It is the number of packets with the largest packet length in the uplink data packets. It is the number of upstream data packets in the data stream; The classification module uses the feature vectors obtained by the feature extraction module to train and identify the model using a random forest model. During training, the features of the wireless recording device data stream are used as positive samples, and the features of the non-wireless recording device data stream are used as negative samples to establish a binary classifier. During detection, the binary classifier is used to analyze whether the space to be detected contains the wireless recording device data stream, thereby determining whether the space to be detected contains the wireless recording device.

Images