Wireless security detection method

Abstract

The invention provides a wireless security detection method, comprising the following steps: periodically receiving a radio frequency scanning report uploaded by a management wireless access point through a radio frequency communication mode, the radio frequency scanning report comprising information of a managed wireless access point of the management wireless access point and information of a neighbor wireless access point, calling a pre-configured threat detection strategy, and judging whether malicious wireless access exists in the wireless local area network or not according to the threat detection strategy and a radio frequency scanning report uploaded by the management wireless access point; if the malicious wireless access point exists in the wireless local area network, information of the malicious wireless access point is recorded in a security log of the wireless intrusion detection system, and a Trap message is sent to a network administrator through network connection to inform the network administrator that the malicious wireless access point exists in the wireless local area network. According to the scheme, comprehensive detection of the whole wireless local area network is realized, a detection blind area is effectively avoided, and the detection accuracy and the detection efficiency are improved.

Description

Technical Field

[0001] The present application relates to the technical field, and in particular to a wireless security detection method. Background Art

[0002] With the rapid development and widespread application of wireless network technology, wireless local area networks (WLANs) are facing many security challenges while bringing convenience to people. Due to the open nature of WLAN channels, wireless networks are easily affected by various network threats. Unauthorized wireless access points (such as malicious access points disguised as authorized access points to release wireless signals), malicious users stealing information, and malicious interference with normal network use frequently occur. Traditional wireless network security detection methods often have problems such as incomplete detection, low efficiency, and difficulty in timely detection of malicious access points. Summary of the invention

[0003] In view of the above defects or deficiencies in the prior art, the present application aims to provide a wireless security detection method, comprising the following steps: Periodically receiving a radio frequency scanning report uploaded by a management wireless access point through a wireless radio frequency communication method, wherein the radio frequency scanning report is a report of the management wireless access point monitoring the surrounding radio frequency environment in real time; the radio frequency scanning report includes information of managed wireless access points and neighboring wireless access points of the management wireless access point, wherein the neighboring wireless access point is another wireless access point that has an overlapping signal coverage range with the management wireless access point and is not managed by the management wireless access point; Retrieving a pre-configured threat detection strategy, and judging whether there is a malicious wireless access point in the wireless local area network according to the threat detection strategy and the radio frequency scanning report uploaded by the management wireless access point; the threat detection strategy includes multiple illegal access types and a determination condition corresponding to each illegal access type; the malicious wireless access point is the neighbor wireless access point whose information meets any determination condition corresponding to the illegal access type; If there is a malicious wireless access point in the wireless local area network, the information of the malicious wireless access point is recorded in the security log of the wireless intrusion detection system, and a Trap message is sent to the network administrator through the network connection to notify the network administrator that there is a malicious wireless access point in the wireless local area network.

[0004] According to the technical solution provided by the embodiment of the present application, each wireless access point has a unique MAC address, and the MAC address can be set as an illegal attribute or a legal attribute by a network administrator; the threat detection strategy includes at least one type of illegal access type and one type of determination condition corresponding to the type of illegal access type; the method also includes pre-configuring the threat detection strategy, and the pre-configuring the threat detection strategy includes at least the following steps: Determine whether the MAC address of the neighbor wireless access point is in the wireless access point database list; If the MAC address of the neighbor wireless access point is not in the wireless access point database list, determining whether the setting of the MAC address of the neighbor wireless access point is an illegal attribute; If the MAC address of the neighbor wireless access point is set to an illegal attribute, the neighbor wireless access point is determined to be a type of illegal access.

[0005] According to the technical solution provided by the embodiment of the present application, the threat detection strategy also includes a type II illegal access type and a type II determination condition corresponding to the type II illegal access type; after determining whether the setting of the MAC address of the neighbor wireless access point is an illegal attribute, the following steps are also included: If the setting of the MAC address of the neighbor wireless access point is not an illegal attribute, determining whether the MAC address of the neighbor wireless access point releases a legal SSID; If the MAC address of the neighbor wireless access point releases a legal SSID, the neighbor wireless access point is determined to be a type II illegal access point.

[0006] According to the technical solution provided by the embodiment of the present application, the threat detection strategy also includes three types of illegal access types and three types of determination conditions corresponding to the three types of illegal access types; after determining whether the MAC address of the neighbor wireless access point is in the wireless access point database list, the following steps are also included: If the MAC address of the neighbor wireless access point is in the wireless access point database list, determining whether the neighbor wireless access point is in a managed online state; If the neighboring wireless access point is not in a managed online state, determining whether the beacon frame of the neighboring wireless access point contains legal vendor information; If the beacon frame of the neighboring wireless access point does not contain legal vendor information, determining whether the neighboring wireless access point has released a legal SSID; If the neighbor wireless access point does not release the legal SSID, the neighbor wireless access point is determined as a third type of illegal access.

[0007] According to the technical solution provided in the embodiment of the present application, the threat detection strategy also includes four types of illegal access types and four types of determination conditions corresponding to the four types of illegal access types; after determining whether the MAC address of the neighboring wireless access point has released a legal SSID, the following steps are also included: If the MAC address of the neighboring wireless access point has not released a legal SSID, determining whether the neighboring wireless access point has released and reported a hidden SSID; If the neighbor wireless access point releases and reports the hidden SSID, the neighbor wireless access point is determined as a type 4 illegal access type.

[0008] According to the technical solution provided by the embodiment of the present application, the threat detection strategy also includes five types of illegal access types and five types of judgment conditions corresponding to the five types of illegal access types; after determining whether the beacon frame of the neighboring wireless access point contains legal vendor information, the following steps are also included: If the beacon frame of the neighboring wireless access point contains legal vendor information, determining whether the channel information of the neighboring wireless access point is correct; If the channel information of the neighbor wireless access point is wrong, the neighbor wireless access point is determined to be a type 5 illegal access point.

[0009] According to the technical solution provided by the embodiment of the present application, the threat detection strategy also includes six types of illegal access types and six types of determination conditions corresponding to the six types of illegal access types; after determining whether the neighboring wireless access point has released a legal SSID, the following steps are also included: If the neighbor wireless access point releases a legal SSID, determining whether the encryption method of the legal SSID released by the neighbor wireless access point is correct; If the encryption mode of the legal SSID released by the neighbor wireless access point is wrong, the neighbor wireless access point is determined as a type 6 illegal access type.

[0010] According to the technical solution provided by the embodiment of the present application, the threat detection strategy also includes seven types of illegal access types and seven types of determination conditions corresponding to the seven types of illegal access types; after determining whether the neighbor wireless access point is in a managed online state, the following steps are also included: If the neighbor wireless access point is in a managed online state, determining whether the management wireless access point corresponding to the neighbor wireless access point has released a legal SSID; If the management wireless access point corresponding to the neighbor wireless access point does not release the legal SSID, the neighbor wireless access point is determined to be a type 7 illegal access point.

[0011] According to the technical solution provided by the embodiment of the present application, the threat detection strategy also includes eight types of illegal access types and eight types of determination conditions corresponding to the eight types of illegal access types; after determining whether the neighbor wireless access point is in a managed online state, the following steps are also included: If the neighboring wireless access point is not in a managed online state, further determining whether the channel of the neighboring wireless access point is legal; If the channel of the neighbor wireless access point is illegal, the neighbor wireless access point is determined to be of type eight illegal access type.

[0012] According to the technical solution provided by the embodiment of the present application, after determining whether the channel information of the neighbor wireless access point is correct, the following steps are also included: If the channel information of the neighbor wireless access point is correct, the process jumps to determining whether the neighbor wireless access point has released a legal SSID.

[0013] Compared with the prior art, the present application has the following beneficial effects: by managing wireless access points to monitor the surrounding RF environment in real time and upload RF scanning reports, it can cover the information of managed wireless access points and neighboring wireless access points, achieve comprehensive detection of the entire wireless LAN, and effectively avoid detection blind spots. The pre-configured threat detection strategy includes multiple illegal access types and corresponding judgment conditions, which can be customized and adjusted according to different network security requirements, improving the flexibility and pertinence of detection. Periodically receiving RF scanning reports and performing real-time analysis can promptly detect malicious wireless access points that meet the illegal access type judgment conditions, improve detection efficiency, and greatly shorten the response time of security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A flowchart of the steps of the wireless security detection method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0015] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0016] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0017] As mentioned in the background technology, in view of the problems in the prior art, the present application proposes a wireless security detection method, which is implemented based on a wireless security detection system, and the detection system includes: UWScontroller is the core control unit of the entire detection system, responsible for managing and coordinating various detection strategies and functions. Users can use it to turn on or off threat detection strategies and countermeasure functions of wireless access points (APs).

[0018] AP: wireless access point, including management wireless access point. Management wireless access point is responsible for radio frequency scanning, real-time monitoring of the surrounding radio frequency environment, and periodically reporting the monitored information to the UWS controller.

[0019] Furthermore, the AP's RF Scan mode can be configured in two modes, namely, Active mode and Sentry mode. The radio in Active mode processes user traffic normally, but periodically scans and monitors information at set intervals, but it can only detect its own working frequency band, such as 2.4G or 5G. The radio in Sentry mode does not process user traffic, but specializes in RF scanning, and monitors all channels in the 2.4G and 5G frequency bands at the same time, so it can obtain RF information more comprehensively, accurately and quickly. Some threats can only be detected based on the RF scan report message reported by the AP in Sentry mode, including AP working on illegal channels and unmanaged access points (Unmanaged AP) accessing the wired network. These two modes can be set by the network administrator. When the detection requirements for neighboring wireless access points are high, it is set to Sentry mode, and when the detection requirements for neighboring wireless access points are low, it is set to Active mode.

[0020] WIDS is a wireless intrusion detection system that is used to detect malicious user attacks and intrusions into wireless networks at an early stage. Its security log is used to record information about APs that are judged to be illegal.

[0021] Network administrator: Responsible for configuring network threat detection policies and receiving Trap messages from the UWS controller to promptly understand the situation of malicious wireless access points (Rouge APs) in the network.

[0022] The AP is connected to the UWS controller through wireless radio frequency communication, and periodically uploads the radio frequency scanning report it monitors to the UWS controller, providing the UWS controller with basic data for determining whether there is a Rouge AP. There is data interaction between the UWS controller and the WIDS. When the UWS controller determines that an AP is a Rouge based on the information reported by the AP and the pre-configured threat detection strategy, it will record the relevant information of the Rouge AP in the security log of the WIDS for subsequent query and analysis of network security events. The UWS controller sends a Trap message to the network administrator through the network connection to notify the network administrator of the existence of Rouge AP in the network, so that the network administrator can take corresponding measures in time. The network administrator interacts with the UWS controller through a specific management interface or tool to configure parameters such as network illegal device detection rules to customize threat detection strategies suitable for the network environment; at the same time, the security log of the WIDS can also be accessed to obtain more detailed network security information, so as to comprehensively evaluate and manage the network security status. The detection system uses the UWS controller as the core hub to connect the AP, WIDS and network administrator, and realizes the effective detection, recording and notification of malicious wireless access points, as well as the countermeasures against malicious wireless access points when necessary, thereby ensuring the safe operation of the wireless network. Therefore, the following detection method is described based on the UWS controller.

[0023] Please refer to Figure 1 As shown, the control method includes the following steps: S1. Periodically receiving a radio frequency scanning report uploaded by a management wireless access point through a wireless radio frequency communication method, wherein the radio frequency scanning report is a report of the management wireless access point monitoring the surrounding radio frequency environment in real time; the radio frequency scanning report includes information of the managed wireless access points and neighboring wireless access points of the management wireless access point, wherein the neighboring wireless access points are other wireless access points that have overlapping signal coverage with the management wireless access point and are not managed by the management wireless access point; Specifically, according to the coverage requirements and signal strength requirements of the wireless LAN, select a suitable location to deploy the management AP to ensure that it can effectively monitor the surrounding RF environment. Consider the signal coverage range of the management AP and try to cover key areas and areas where neighboring wireless access points may exist. Set parameters for the management AP, including the working frequency band, channel, and transmit power, to optimize its performance and monitoring effect. Enable the RF scanning function of the management AP and set the scanning cycle to ensure that the surrounding RF environment can be monitored in real time. Collect information about surrounding wireless access points, such as the media access control address (MAC address), service set identifier (SSID), signal strength, working frequency band, channel, etc.

[0024] S2, calling a pre-configured threat detection strategy, and judging whether there is a malicious wireless access point in the wireless local area network according to the threat detection strategy and the radio frequency scanning report uploaded by the management wireless access point; the threat detection strategy includes multiple illegal access types and a determination condition corresponding to each illegal access type; the malicious wireless access point is the neighbor wireless access point whose information meets any determination condition corresponding to the illegal access type; S3. If there is a malicious wireless access point in the wireless local area network, the information of the malicious wireless access point is recorded in the security log of the wireless intrusion detection system, and a Trap message is sent to the network administrator through the network connection to notify the network administrator that there is a malicious wireless access point in the wireless local area network.

[0025] Specifically, after receiving a Trap message (a notification message in the network management protocol), the network administrator immediately checks the message content to understand the situation of the malicious wireless access point. Log in to the WIDS system, view the detailed records in the security log, and further analyze the activities and impact of the malicious wireless access point. According to the type and degree of harm of the malicious wireless access point, take appropriate measures, such as shutting down illegal access points, adjusting network configuration, and strengthening security protection. Continuously monitor the network to ensure that malicious wireless access points are effectively handled and network security is guaranteed.

[0026] In a preferred embodiment, each wireless access point has a unique MAC address, and the MAC address can be set as an illegal attribute or a legal attribute by a network administrator; the threat detection strategy includes at least one type of illegal access type and one type of determination condition corresponding to the type of illegal access type; the method also includes pre-configuring the threat detection strategy, and the pre-configuring the threat detection strategy includes at least the following steps: Determine whether the MAC address of the neighbor wireless access point is in the wireless access point database list; If the MAC address of the neighbor wireless access point is not in the wireless access point database list, determining whether the setting of the MAC address of the neighbor wireless access point is an illegal attribute; If the MAC address of the neighbor wireless access point is set to an illegal attribute, the neighbor wireless access point is determined to be a type of illegal access.

[0027] Specifically, the network administrator organizes and records the MAC addresses and other information of all legal wireless access points to form a wireless access point database list. This list can be stored in a special database management system, or saved in the form of a file on a network management server. If a matching MAC address is found in the database list, it means that the neighboring wireless access point is a known legal access point, and no further illegal attribute judgment is performed. If no matching MAC address is found, the neighboring wireless access point is determined to be a type of illegal access.

[0028] In this embodiment, the administrator manually sets the attribute of a certain MAC AP as an illegal AP in the wireless access point database on the AC, and such an AP will be detected as a threat. The AC searches the AP database according to the MAC address of the scanned AP. If the AP is found and the AP is set as illegal, then the AP is a type of malicious wireless access point of illegal access type.

[0029] In a preferred embodiment, the threat detection strategy further includes a type II illegal access type and a type II determination condition corresponding to the type II illegal access type; after determining whether the setting of the MAC address of the neighbor wireless access point is an illegal attribute, the following steps are also included: If the setting of the MAC address of the neighbor wireless access point is not an illegal attribute, determining whether the MAC address of the neighbor wireless access point releases a legal SSID; If the MAC address of the neighbor wireless access point releases a legal SSID, the neighbor wireless access point is determined to be a type II illegal access point.

[0030] Specifically, the definition and scope of legal SSIDs are clarified, and the network administrator determines which SSIDs are authorized legal SSIDs and records them. When it is determined that the MAC address of the neighboring wireless access point is not in the wireless access point database list and is not an illegal attribute, WIDS begins to analyze the SSID broadcast by the neighboring wireless access point. The received SSID is compared with the predetermined legal SSID. If it is found that the SSID broadcast by the neighboring wireless access point matches any legal SSID, it is considered that the neighboring wireless access point has released a legal SSID, and the neighboring wireless access point can be determined as a type II illegal access type.

[0031] This embodiment takes into account that hackers may use illegal APs to impersonate legitimate SSIDs to defraud client access and obtain security information such as user names and passwords. This scenario is quite common in practice. In order to detect such illegal APs, the AC will determine whether the illegal AP is in the legal AP database based on its MAC address. If the illegal AP impersonates a legitimate SSID and its MAC address is not in the legal AP database, then the AP is a malicious wireless access point of type II illegal access.

[0032] In a preferred embodiment, the threat detection strategy further includes three types of illegal access and three types of determination conditions corresponding to the three types of illegal access; after determining whether the MAC address of the neighbor wireless access point is in the wireless access point database list, the following steps are also included: If the MAC address of the neighbor wireless access point is in the wireless access point database list, determining whether the neighbor wireless access point is in a managed online state; If the neighboring wireless access point is not in a managed online state, determining whether the beacon frame of the neighboring wireless access point contains legal vendor information; If the beacon frame of the neighboring wireless access point does not contain legal vendor information, determining whether the neighboring wireless access point has released a legal SSID; If the neighbor wireless access point does not release the legal SSID, the neighbor wireless access point is determined as a third type of illegal access.

[0033] Among them, the beacon frame is a management frame in the wireless local area network (WLAN), and the vendor information refers to the information related to the device manufacturer (vendor). In a wireless network, it is usually included in the beacon frame or other frames to identify the manufacturer of the device.

[0034] Specifically, the scope of legal vendor information is determined, and the network administrator sorts out legal equipment manufacturer information as a basis for judging whether the vendor information is legal. WIDS checks the access point status information corresponding to the MAC address in the database to determine whether it is in a managed online state, which can be judged by communication with the management system or a specific status identifier. If the access point is in a managed online state, it is considered normal and no further judgment is made. If it is not in a managed online state, the next step of judgment is entered. WIDS analyzes the beacon frame sent by the neighboring wireless access point and extracts the vendor information therein. The extracted vendor information is compared with the predetermined legal vendor information. If matching vendor information is found, it is considered that the beacon frame of the neighboring wireless access point contains legal vendor information. If no matching vendor information is found, the next step of judgment is entered. If the beacon frame of the neighboring wireless access point does not contain legal vendor information, it is judged whether the neighboring wireless access point has released a legal SSID, and the SSID broadcast by the neighboring wireless access point is compared with the legal SSID as in the judgment method of the second type of illegal access. If the legal SSID is not released, the neighbor wireless access point is determined as type 3 illegal access.

[0035] This embodiment takes into account that a hacker may impersonate the MAC of a legitimate AP and send a legitimate SSID, but the Vendor field in its beacon frame may be empty. The AC will check whether there is a vendor field in the beacon frame sent by the AP. If not, the AP is a malicious wireless access point of type III illegal access.

[0036] In a preferred embodiment, the threat detection strategy further includes four types of illegal access and four types of determination conditions corresponding to the four types of illegal access; after determining whether the MAC address of the neighbor wireless access point has released a legal SSID, the following steps are also included: If the MAC address of the neighboring wireless access point has not released a legal SSID, determining whether the neighboring wireless access point has released and reported a hidden SSID; If the neighbor wireless access point releases and reports the hidden SSID, the neighbor wireless access point is determined as a type 4 illegal access type.

[0037] Specifically, the NetStumbler tool can be used for active detection, sending detection requests to each possible wireless channel to see if there is a response. If the detection AP detects that the MAC of the neighbor AP is not in the legal AP database, and detects that the Beacon frame does not contain the SSID field, that is, the neighbor AP releases the hidden SSID, then the neighbor AP is determined to be a type 4 illegal access type.

[0038] This embodiment takes into account that in order to avoid being detected, hackers may not include the SSID field in the beacon frame, but they can still send a probe response frame to the client that sends a probe request to deceive the client to access and obtain security information. In order to detect this situation, four types of illegal access judgment conditions are set.

[0039] In a preferred embodiment, the threat detection strategy further includes five types of illegal access and five types of determination conditions corresponding to the five types of illegal access; after determining whether the beacon frame of the neighbor wireless access point contains legal vendor information, the following steps are also included: If the beacon frame of the neighboring wireless access point contains legal vendor information, determining whether the channel information of the neighboring wireless access point is correct; If the channel information of the neighbor wireless access point is wrong, the neighbor wireless access point is determined to be a type 5 illegal access point.

[0040] Specifically, first clarify the scope and standards of legal channel information. The network administrator determines which channels are legal channels allowed to be used in a specific wireless LAN environment. WIDS analyzes the channel settings of neighboring wireless access points and compares them with the predetermined legal channel information. This can be determined by reading the channel parameters in the RF scan report or directly monitoring the channel of the wireless signal. If it is found that the channel information of the neighboring wireless access point is wrong, that is, it is not within the legal channel range, the neighboring wireless access point is determined to be a type 5 illegal access type.

[0041] This embodiment takes into account that a hacker may impersonate a Mac of a legitimate AP, but the channel through which the beacon frame is sent is inconsistent with the channel of the legitimate AP. The working channel of the legitimate AP is reported to the AC by the legitimate AP, so the AC knows the current working channel of the legitimate AP. Since the AP may change its channel due to reasonable reasons such as manual configuration and radar detection, and the update of information and the arrival of the RF scan report are asynchronous, it is possible that the information in the RF scan report shows that the working channel of the AP has changed, but the actual configuration change information has not yet been delivered. Therefore, the judgment condition of this detection is that the channel mismatch is detected in two RF scan reports within 2* Scan-Report-Interval (RF scan report time interval) before it will be identified as a threat.

[0042] In a preferred embodiment, the threat detection strategy further includes six types of illegal access and six types of determination conditions corresponding to the six types of illegal access; after determining whether the neighbor wireless access point has released a legal SSID, the following steps are also included: If the neighbor wireless access point releases a legal SSID, determining whether the encryption method of the legal SSID released by the neighbor wireless access point is correct; If the encryption mode of the legal SSID released by the neighbor wireless access point is wrong, the neighbor wireless access point is determined as a type 6 illegal access type.

[0043] Specifically, determine the encryption method standard for a legal SSID. The network administrator specifies which encryption methods are recognized legal encryption methods in the wireless LAN. WIDS analyzes the encryption method of the legal SSID released by the neighboring wireless access point and compares it with the predetermined legal encryption method standard. This can be determined by monitoring the encryption parameters of the wireless signal or reading the encryption information in the RF scan report. If it is found that the encryption method of the legal SSID released by the neighboring wireless access point is wrong, that is, it does not meet the legal encryption method standard, the neighboring wireless access point is determined to be a type 6 illegal access type.

[0044] In a preferred embodiment, the threat detection strategy further includes seven types of illegal access and seven types of determination conditions corresponding to the seven types of illegal access; after determining whether the neighbor wireless access point is in a managed online state, the following steps are also included: If the neighbor wireless access point is in a managed online state, determining whether the management wireless access point corresponding to the neighbor wireless access point has released a legal SSID; If the management wireless access point corresponding to the neighbor wireless access point does not release the legal SSID, the neighbor wireless access point is determined to be a type 7 illegal access point.

[0045] Specifically, the definition and scope of legal SSIDs are clarified, and the network administrator determines which SSIDs are authorized and legal SSIDs and keeps records. When it is determined that the neighboring wireless access point is in a managed online state, WIDS begins to check the SSID broadcast by its corresponding management wireless access point. The SSID of the management wireless access point is compared with the predetermined legal SSID. If the management wireless access point does not broadcast a legal SSID, it is determined to be a type 7 illegal access.

[0046] In a preferred embodiment, the threat detection strategy further includes eight types of illegal access and eight types of determination conditions corresponding to the eight types of illegal access; after determining whether the neighbor wireless access point is in a managed online state, the following steps are also included: If the neighboring wireless access point is not in a managed online state, further determining whether the channel of the neighboring wireless access point is legal; If the channel of the neighbor wireless access point is illegal, the neighbor wireless access point is determined to be of type eight illegal access type.

[0047] For example, different countries have different regulations on radio frequency resources. Some channels are legal in some countries but illegal in other countries. If the AP works on an illegal channel, this step can detect it. The legal channels stipulated by China (CN) are 1-13, and the legal channels stipulated by the United States (US) are 1-11. If the country code is set to US on the AC, then the AP on channel 12 or 13 will be detected as a threat.

[0048] In a preferred embodiment, after determining whether the channel information of the neighbor wireless access point is correct, the following steps are also included: If the channel information of the neighbor wireless access point is correct, the process jumps to determining whether the neighbor wireless access point has released a legal SSID.

[0049] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and its core ideas of this application. The above is only the preferred implementation method of this application. It should be pointed out that due to the limitations of textual expression and the objective existence of infinite specific structures, ordinary technicians in this technical field can make several improvements, modifications or changes without departing from the principles of the present invention, and can also combine the above technical features in an appropriate manner; these improvements, modifications, changes or combinations, or the direct application of the inventive concept and technical solution to other occasions without improvement, should be regarded as the scope of protection of this application.

Claims

1. A wireless security detection method, characterized in that: The following steps are involved: Periodically receiving a radio frequency scanning report uploaded by a management wireless access point through a wireless radio frequency communication method, wherein the radio frequency scanning report is a report of the management wireless access point monitoring the surrounding radio frequency environment in real time; the radio frequency scanning report includes information of managed wireless access points and neighboring wireless access points of the management wireless access point, wherein the neighboring wireless access point is another wireless access point that has an overlapping signal coverage range with the management wireless access point and is not managed by the management wireless access point; Retrieving a pre-configured threat detection strategy, and judging whether there is a malicious wireless access point in the wireless local area network according to the threat detection strategy and the radio frequency scanning report uploaded by the management wireless access point; the threat detection strategy includes multiple illegal access types and a determination condition corresponding to each illegal access type; the malicious wireless access point is the neighbor wireless access point whose information meets any determination condition corresponding to the illegal access type; If there is a malicious wireless access point in the wireless local area network, the information of the malicious wireless access point is recorded in the security log of the wireless intrusion detection system, and a Trap message is sent to the network administrator through the network connection to notify the network administrator that there is a malicious wireless access point in the wireless local area network.

2. The wireless security detection method according to claim 1, characterized in that: Each wireless access point has a unique MAC address, and the MAC address can be set as an illegal attribute or a legal attribute by a network administrator; the threat detection strategy includes at least one type of illegal access type and a type of determination condition corresponding to the type of illegal access type; the method also includes pre-configuring the threat detection strategy, and the pre-configuring the threat detection strategy includes at least the following steps: Determine whether the MAC address of the neighbor wireless access point is in the wireless access point database list; If the MAC address of the neighbor wireless access point is not in the wireless access point database list, determining whether the setting of the MAC address of the neighbor wireless access point is an illegal attribute; If the MAC address of the neighbor wireless access point is set to an illegal attribute, the neighbor wireless access point is determined to be a type of illegal access.

3. The wireless security detection method according to claim 2, characterized in that: The threat detection strategy also includes a second type of illegal access type and a second type of determination condition corresponding to the second type of illegal access type; after determining whether the setting of the MAC address of the neighbor wireless access point is an illegal attribute, the following steps are also included: If the setting of the MAC address of the neighbor wireless access point is not an illegal attribute, determining whether the MAC address of the neighbor wireless access point releases a legal SSID; If the MAC address of the neighbor wireless access point releases a legal SSID, the neighbor wireless access point is determined to be a type II illegal access point.

4. The wireless security detection method according to claim 2, characterized in that: The threat detection strategy also includes three types of illegal access and three types of determination conditions corresponding to the three types of illegal access; after determining whether the MAC address of the neighbor wireless access point is in the wireless access point database list, the following steps are also included: If the MAC address of the neighbor wireless access point is in the wireless access point database list, determining whether the neighbor wireless access point is in a managed online state; If the neighboring wireless access point is not in a managed online state, determining whether the beacon frame of the neighboring wireless access point contains legal vendor information; If the beacon frame of the neighboring wireless access point does not contain legal vendor information, determining whether the neighboring wireless access point has released a legal SSID; If the neighbor wireless access point does not release the legal SSID, the neighbor wireless access point is determined as a third type of illegal access.

5. The wireless security detection method according to claim 3, characterized in that: The threat detection strategy also includes four types of illegal access and four types of determination conditions corresponding to the four types of illegal access; after determining whether the MAC address of the neighbor wireless access point has released a legal SSID, the following steps are also included: If the MAC address of the neighboring wireless access point has not released a legal SSID, determining whether the neighboring wireless access point has released and reported a hidden SSID; If the neighbor wireless access point releases and reports the hidden SSID, the neighbor wireless access point is determined as a type 4 illegal access type.

6. The wireless security detection method according to claim 4, characterized in that: The threat detection strategy also includes five types of illegal access and five types of determination conditions corresponding to the five types of illegal access; after determining whether the beacon frame of the neighbor wireless access point contains legal vendor information, the following steps are also included: If the beacon frame of the neighboring wireless access point contains legal vendor information, determining whether the channel information of the neighboring wireless access point is correct; If the channel information of the neighbor wireless access point is wrong, the neighbor wireless access point is determined to be a type 5 illegal access point.

7. The wireless security detection method according to claim 4, characterized in that: The threat detection strategy also includes six types of illegal access and six types of determination conditions corresponding to the six types of illegal access; after determining whether the neighbor wireless access point has released a legal SSID, the following steps are also included: If the neighbor wireless access point releases a legal SSID, determining whether the encryption method of the legal SSID released by the neighbor wireless access point is correct; If the encryption mode of the legal SSID released by the neighbor wireless access point is wrong, the neighbor wireless access point is determined as a type 6 illegal access type.

8. The wireless security detection method according to claim 4, characterized in that: The threat detection strategy also includes seven types of illegal access and seven types of determination conditions corresponding to the seven types of illegal access; after determining whether the neighbor wireless access point is in a managed online state, the following steps are also included: If the neighbor wireless access point is in a managed online state, determining whether the management wireless access point corresponding to the neighbor wireless access point has released a legal SSID; If the management wireless access point corresponding to the neighbor wireless access point does not release the legal SSID, the neighbor wireless access point is determined to be a type 7 illegal access point.

9. The wireless security detection method according to claim 7, characterized in that: The threat detection strategy also includes eight types of illegal access and eight types of determination conditions corresponding to the eight types of illegal access; after determining whether the neighbor wireless access point is in a managed online state, the following steps are also included: If the neighboring wireless access point is not in a managed online state, further determining whether the channel of the neighboring wireless access point is legal; If the channel of the neighbor wireless access point is illegal, the neighbor wireless access point is determined to be of type eight illegal access type.

10. The wireless security detection method according to claim 6, characterized in that: After determining whether the channel information of the neighbor wireless access point is correct, the following steps are also included: If the channel information of the neighbor wireless access point is correct, the process jumps to determining whether the neighbor wireless access point has released a legal SSID.

Images