Smart phone Bluetooth attack monitoring method based on equipment state recognition

Abstract

The invention is suitable for the technical field of mobile device security monitoring, and particularly relates to a smart phone Bluetooth attack monitoring method based on device state recognition, and the method comprises the steps: obtaining ART sequence data, dividing the ART sequence data according to the type, and labeling the ART sequence data; performing denoising processing on the ART sequence data to obtain ART group data; the method comprises the following steps: constructing and training an LSTM model, selecting a cross entropy as a loss function of the LSTM model, and solving the LSTM model by adopting a gradient descent method to obtain a minimum loss function and a model reference value; according to the invention, the idea of channel measurement is introduced, and the Bluetooth state of the smart phone is judged through the response time of the Bluetooth protocol L2CAP ping instead of directly physically contacting or observing the smart phone, so that the state of the Bluetooth equipment is remotely monitored. In addition, a deep learning algorithm LSTM is introduced into Bluetooth equipment state recognition, and a loss function of cross entropy and an iteration method of gradient descent are used in the model.

Description

Technical Field

[0001] The present invention belongs to the technical field of mobile device security monitoring, and in particular relates to a smart phone Bluetooth attack monitoring method based on device status identification. Background Art

[0002] With the rapid development of the Internet of Things, the era of the Internet of Everything is coming. Bluetooth, which constitutes the personal area network, has become the first choice for small-scale and indoor communications. Bluetooth technology has the characteristics of intelligence, low power consumption, high transmission speed and low cost, and has occupied a large share in the IoT application market. At present, Bluetooth technology has been widely used in IoT terminal devices, such as bracelets, light bulbs, smart locks, smart medical devices, etc. The widespread deployment of Bluetooth devices has greatly increased the attack surface, giving attackers more ways to launch attacks and threaten the security of Bluetooth devices. Therefore, it is very important to ensure the security of Bluetooth devices. Smartphones, as one of the most common Bluetooth devices, are vulnerable to a variety of Bluetooth attacks, which makes Bluetooth attack monitoring for smartphones particularly important.

[0003] Existing Bluetooth attack monitoring solutions mainly identify Bluetooth attacks through Bluetooth communication traffic, but the Bluetooth communication traffic of smartphones is difficult to capture, and the monitoring effect of Bluetooth attacks is not good. Summary of the invention

[0004] The purpose of the present invention is to provide a smart phone Bluetooth attack monitoring method based on device status identification, aiming to solve the problem that Bluetooth attacks are identified through Bluetooth communication traffic, while the Bluetooth communication traffic of smart phones is difficult to capture and the monitoring effect of Bluetooth attacks is poor.

[0005] The present invention is implemented as follows: a method for monitoring Bluetooth attacks on smart phones based on device status recognition, the method comprising:

[0006] By simulating different Bluetooth attacks on the attacking host, the ART sequence data received by the attacked host is monitored, and the ART sequence data is divided and labeled according to the type;

[0007] De-noising the ART sequence data, and segmenting the de-noised ART sequence data to obtain ART group data;

[0008] Build and train the LSTM model, select cross entropy as the loss function of the LSTM model, use the gradient descent method to solve the LSTM model, and obtain the minimum loss function and model reference value.

[0009] Preferably, the calculation formula of the cross entropy is:

[0010]

[0011] in, y represents the predicted output and the actual value respectively.

[0012] Preferably, in the step of solving the LSTM model using the gradient descent method, the following definitions are performed:

[0013] z=W T +b

[0014] σ(z)=sigmoid(z)

[0015]

[0016] Where W, T and b represent weight matrix, matrix transpose and bias respectively;

[0017] Preferably, in the step of segmenting the denoised ART sequence data, a segmentation algorithm is used to segment the data.

[0018] Preferably, in the step of solving the LSTM model using the gradient descent method, the derivation formula is:

[0019]

[0020] w j =w j -αdw j

[0021] b=-αdb

[0022] Among them, j and α represent: the jth eigenvalue and the learning rate respectively.

[0023] Preferably, during the training of the LSTM model, one sample and two eigenvalues ​​(X1, X2) correspond to two weights (w1, w2).

[0024] Preferably, during the process of training the LSTM model, it is trained using the ART group data.

[0025] The method for monitoring Bluetooth attacks on smart phones based on device status recognition provided by the present invention introduces the idea of ​​measuring channels. Instead of directly physically contacting or observing the smart phone, the Bluetooth status of the smart phone is determined by the response time of the Bluetooth protocol L2CAP ping, thereby realizing remote monitoring of the Bluetooth device status. In addition, the deep learning algorithm LSTM is introduced into the recognition of the Bluetooth device status, and the cross entropy loss function and the gradient descent iteration method are used in the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 is a schematic diagram of a Bluetooth attack monitoring process provided by an embodiment of the present invention;

[0027] Figure 2 This is a schematic diagram of introducing the LSTM algorithm provided by an embodiment of the present invention;

[0028] Figure 3 It is a schematic diagram of the data preprocessing process provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0030] like Figure 1 FIG. 1 is a schematic diagram of a Bluetooth attack monitoring process provided by an embodiment of the present invention, wherein the method comprises:

[0031] By simulating different Bluetooth attacks on the attacking host, the ART sequence data received by the attacked host is monitored, and the ART sequence data is divided and labeled according to the type;

[0032] De-noising the ART sequence data, and segmenting the de-noised ART sequence data to obtain ART group data;

[0033] Build and train the LSTM model, select cross entropy as the loss function of the LSTM model, use the gradient descent method to solve the LSTM model, and obtain the minimum loss function and model reference value.

[0034] In this embodiment, the ART sequence data is the time interval from when the monitoring host sends a Ping request packet to when it receives a response packet from the smartphone. The ART sequence data can be understood as an array of response times, which is monitored by the monitoring host.

[0035] Applied to Bluetooth monitoring of electric vehicles, a denoising algorithm is used to remove noise from ART sequence data, and the denoised ART sequence is segmented by a segmentation algorithm to obtain ART group data as the original data for subsequent manual analysis and machine learning algorithms; different Bluetooth attacks are simulated by attacking the host, and the ART sequence data collected by the host is monitored at the same time, and the ART sequence data is divided and labeled according to type; cross entropy is selected as the loss function of the LSTM algorithm, and the gradient descent method is used to gradually solve the model to obtain the minimum loss function and model reference value.

[0036] The calculation formula for cross entropy is:

[0037]

[0038] in, y represents the predicted output and the actual value respectively.

[0039] In the embodiment of the present invention, the gradient descent method is used to gradually solve and obtain the minimum loss function and model reference value.

[0040] In the embodiment of the present invention, the (single) gradient derivative formula needs to be defined as follows:

[0041] z=W T +b

[0042] σ(z)=sigmoid(z)

[0043]

[0044] Where W, T, and b represent: weight matrix, matrix transpose, and bias, respectively.

[0045] In the embodiment of the present invention, a sample and two eigenvalues ​​(X1, X2) correspond to two weights (w1, w2).

[0046] In the embodiment of the present invention, z=w1x1+w2x2+b, a=σ(z), and the partial derivative of L(a, y) with respect to w is calculated.

[0047] In the embodiment of the present invention, the derivation formula is:

[0048]

[0049]

[0050] w j =w j -αdw j

[0051] b=-αdb

[0052] Among them, j and α represent: the jth eigenvalue and the learning rate respectively.

[0053] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for monitoring Bluetooth attacks on smart phones based on device status recognition, characterized in that: The method comprises: By simulating different Bluetooth attacks on the attacking host, the ART sequence data received by the attacked host is monitored, and the ART sequence data is divided and labeled according to the type; De-noising the ART sequence data, and segmenting the de-noised ART sequence data to obtain ART group data; Build and train the LSTM model, select cross entropy as the loss function of the LSTM model, use the gradient descent method to solve the LSTM model, and obtain the minimum loss function and model reference value.

2. The method for monitoring Bluetooth attacks on smart phones based on device status recognition according to claim 1 is characterized in that: The calculation formula of the cross entropy is: in, y represents the predicted output and the actual value respectively, and i is the number.

3. The method for monitoring Bluetooth attacks on smart phones based on device status recognition according to claim 1 is characterized in that: In the steps of solving the LSTM model using the gradient descent method, the following definitions are made: z=W T +b σ(z)=sigmoid(z) Where W, T, b, and z represent the weight matrix, matrix transpose, bias, and weighted sum, respectively.

4. The method for monitoring smart phone Bluetooth attacks based on device status recognition according to claim 1 is characterized in that: In the step of segmenting the denoised ART sequence data, a segmentation algorithm is used to segment the data.

5. The method for monitoring smart phone Bluetooth attacks based on device status recognition according to claim 3 is characterized in that: In the step of solving the LSTM model using the gradient descent method, the derivative formula is: In j =in j -αdw j b=-αdb Among them, w j , j, α and y represent: the jth weight parameter, the jth eigenvalue, the learning rate and the actual label respectively.

6. The method for monitoring smart phone Bluetooth attacks based on device status recognition according to claim 1 is characterized in that: During the training of the LSTM model, one sample and two eigenvalues ​​(X1, X2) correspond to two weights (w1, w2).

7. The method for monitoring smart phone Bluetooth attacks based on device status recognition according to claim 1 is characterized in that: During the training of the LSTM model, it is trained using the ART group data.

Images