Syware detection method and device based on WiFi hotspot flow analysis

Abstract

The embodiment of the invention provides a spyware detection method and device based on WiFi hotspot traffic analysis, and the method comprises the steps: capturing the traffic data of all devices connected to a WiFi hotspot, and storing the traffic data of the devices in a time sequence database according to a timestamp; carrying out data packet classification and time sequence analysis on the equipment traffic data based on a time sequence database to obtain a traffic analysis result; and performing comprehensive judgment on the flow analysis result based on a preset rule set, and generating a spyware detection report. According to the scheme, the spyware behavior of the equipment based on the WiFi hotspot can be accurately and efficiently detected.

Description

Technical Field

[0001] The present invention relates to the technical field of device network security, and in particular to a spyware detection method, device, computing device and storage medium based on WiFi hotspot traffic analysis. Background Art

[0002] While mobile devices provide convenient services to users, they also face increasingly severe security threats, especially malware. Among them, spyware, as a highly concealed and potentially dangerous malware, has become a hot topic in the field of network security research.

[0003] Spyware is a malicious program that can run secretly on a user's device without the user's permission. Its main function is to monitor the user's activities, steal sensitive information (such as location information, communication records, private files and photos, browsing history, etc.), and send this information to the attacker's remote server. This malicious behavior poses a great threat to personal privacy and corporate confidential information.

[0004] Traditional mobile security software mainly relies on signature detection and abnormal behavior analysis to identify malware. Among them, signature detection can only identify known malicious behavior patterns such as specific IP addresses, port numbers, and data packet contents, and cannot provide effective protection for new, undiscovered spyware or variant programs. In addition, malicious behavior can bypass signature detection by means of encrypted traffic, obfuscation, or disguise. In order to improve detection capabilities, the signature library needs to be continuously updated, which increases operation and maintenance costs and workload. Traffic analysis based on abnormal behavior learns the normal behavior pattern in the network environment and uses it as a benchmark to detect abnormal traffic that deviates from the benchmark. This method does not rely on known signatures and can detect unknown attacks. However, when the network environment changes significantly, false alarms are prone to occur, and a large amount of historical data is required to train and adjust the benchmark model. Summary of the invention

[0005] In order to solve the problems existing in the prior art, this solution proposes a spyware detection method based on WiFi hotspot traffic analysis, which does not rely on the feature signatures or behavioral characteristics of the software itself, but judges whether there is malicious behavior based on the communication mode and data transmission characteristics, and can reduce the false alarm rate in complex network environments.

[0006] According to a first aspect of the present invention, a spyware detection method based on WiFi hotspot traffic analysis is provided, comprising: capturing traffic data of all devices connected to the WiFi hotspot, and storing the device traffic data in a time series database according to timestamps; performing data packet classification and time series analysis on the device traffic data based on the time series database to obtain traffic analysis results; and performing comprehensive judgment on the traffic analysis results based on a preset rule set to generate a spyware detection report.

[0007] By adopting the above technical solutions, the network traffic of all connected devices can be captured in real time on the Wi-Fi hotspot device, including characteristic information such as the size, direction, protocol and time interval of the data packet, so that the traffic data can be captured efficiently and imperceptibly without affecting the user experience. Modeling the traffic characteristics of spyware based on multi-dimensional rules (directivity, size, frequency, etc.) can reduce the false alarm rate.

[0008] Optionally, in the spyware detection method based on WiFi hotspot traffic analysis provided by the present invention, network traffic data of all devices connected to the WiFi hotspot are captured in real time based on a deep packet inspection tool; device information, session information and data packet feature information are filtered out from the network traffic data, the session information includes source IP, target IP, source port, target port and protocol type, and the data packet feature information includes timestamp, data packet size, transmission direction and transmission frequency; the network traffic data is stored in a time series database according to timestamps, and each record includes timestamp, data packet size, data packet transmission direction and transmission frequency.

[0009] Optionally, in the spyware detection method based on WiFi hotspot traffic analysis provided by the present invention, data packets are divided into normal communication traffic and malicious communication traffic according to data packet feature information; time series analysis is performed on the normal communication traffic and malicious communication traffic, and bursts of abnormal traffic are detected according to the timestamp, transmission frequency, data packet size and transmission direction of the data packet, and abnormal traffic that deviates from the normal communication traffic baseline is marked.

[0010] The above technical solution can effectively distinguish normal traffic from malicious traffic by extracting the characteristics of data packets (such as source IP, destination IP, port, protocol type, etc.). By establishing a "baseline" model of normal communication traffic, abnormal traffic that deviates from this baseline can be identified, which helps to detect potential spyware behavior in a timely manner.

[0011] Optionally, in the spyware detection method based on WiFi hotspot traffic analysis provided by the present invention, the data packets of the traffic data are classified according to the protocol type; for the data packets of each protocol type, the data packets are marked as uplink or downlink according to the IP address and the port, the number of data packets sent or received is counted within a fixed time window, and the size distribution of each data packet is counted; by comparing the traffic characteristics of normal applications, abnormal traffic characteristics that do not conform to normal communication behavior are found, and the data packets are divided into normal communication traffic and malicious communication traffic, the traffic characteristics of normal applications are that the data packet size is diversified and the communication frequency is consistent with the application scenario, and the abnormal traffic characteristics are that the data packet size is fixed and is a small data packet, the uplink frequency is higher than the downlink frequency, or the communication port is a non-standard port.

[0012] Optionally, in the spyware detection method based on WiFi hotspot traffic analysis provided by the present invention, the preset rule set includes: if the proportion of small packets within a preset time exceeds a preset threshold, it is marked as suspicious traffic; the uploaded data at a fixed interval is marked as abnormal traffic; the asymmetric traffic in which the upstream traffic is greater than the downstream traffic is marked as abnormal traffic; the communication of a specific port is marked as suspicious traffic, and each rule in the preset rule set has a corresponding priority.

[0013] Optionally, in the spyware detection method based on WiFi hotspot traffic analysis provided by the present invention, abnormal traffic and suspicious traffic that conform to a preset rule set are weighted and scored based on the priority of the rules, and traffic with a score higher than a threshold is marked as high-risk behavior; when high-risk behavior is detected, the device is isolated from communication; based on the detected suspicious traffic or abnormal traffic, a detection report is generated, and the detection report includes the IP address, port number, protocol type, traffic characteristics, behavior description and operation suggestions of the device.

[0014] The above technical solution, through rule-weighted scoring based on traffic analysis, dynamic isolation response and detailed detection report generation, can respond quickly to malicious behavior in the early stages of discovery and reduce potential damage to the device.

[0015] Optionally, in the spyware detection method based on WiFi hotspot traffic analysis provided by the present invention, historical traffic data is collected; a detection model based on traffic analysis is trained based on the historical traffic data and known normal communication patterns to obtain a trained detection model; and abnormal behavior prediction is performed on real-time traffic data based on the trained detection model.

[0016] According to a second aspect of the present invention, a spyware detection device based on WiFi hotspot traffic analysis is provided, comprising: a capture module, an analysis module and a generation module. Among them, the capture module is used to capture the device traffic data of all devices connected to the WiFi hotspot, and store the device traffic data in a time series database according to timestamps; the analysis module is used to classify data packets and perform time series analysis on the device traffic data based on the time series database to obtain traffic analysis results; the generation module is used to make a comprehensive judgment on the traffic analysis results based on a preset rule set and generate a spyware detection report.

[0017] According to a third aspect of the present invention, there is provided a computing device, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be suitable for execution by at least one processor, and the program instructions include instructions for executing the above-mentioned spyware detection method based on WiFi hotspot traffic analysis.

[0018] According to a fourth aspect of the present invention, a readable storage medium storing program instructions is provided. When the program instructions are read and executed by a computing device, the computing device executes the above-mentioned spyware detection method based on WiFi hotspot traffic analysis.

[0019] In summary, the spyware detection method and device based on WiFi hotspot traffic analysis provided by the present invention can at least achieve the following technical effects: 1. By detecting abnormal behavior of device traffic data and processing different types of traffic in different layers, it can identify high-risk spyware behaviors in real time, continuously monitor potential risks, and promptly detect and block spyware activities; 2. Traffic is captured and analyzed through WiFi hotspots. Users do not need to install additional software or configuration, which does not affect the user experience of the device. It can be used on a variety of devices and operating systems and can be deployed in different WiFi network environments.

[0020] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A block diagram of a computing device 100 according to an embodiment of the present invention is shown; Figure 2 A schematic flow chart of a spyware detection method 200 based on WiFi hotspot traffic analysis according to an embodiment of the present invention is shown; Figure 3 A schematic structural diagram of a spyware detection device 300 based on WiFi hotspot traffic analysis according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0022] The core goal of the disclosed embodiment is to detect and identify potential spyware activities by analyzing network traffic connected to WiFi hotspots. Combining characteristics such as packet size, time interval, transmission direction, etc., using rule sets and statistical models, the detection results are obtained.

[0023] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0024] Figure 1 FIG. 1 is a schematic diagram showing the structure of a computing device 100 according to an embodiment of the present invention. Figure 1 As shown, in a basic configuration 102, computing device 100 includes system memory 106 and one or more processors 104. A memory bus 108 may be used for communication between processor 104 and system memory 106.

[0025] The processor 104 may be any type of processor, including but not limited to a microprocessor (µP), a microcontroller (µC), a digital signal processor (DSP), or any combination thereof. The processor 104 may include one or more levels of cache, such as a level 1 cache 110 and a level 2 cache 112, a processor core 114, and registers 116. An example processor core 114 may include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 118 may be used with the processor 104, or in some implementations, the memory controller 118 may be an internal part of the processor 104.

[0026] The system memory 106 may be any type of memory, including but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.) or any combination thereof. The physical memory in the computing device generally refers to the volatile memory RAM, and the data in the disk needs to be loaded into the physical memory before it can be read by the processor 104. The system memory 106 may include an operating system 120, one or more applications 122, and program data 124. In some embodiments, the application 122 may be arranged to execute instructions on the operating system by one or more processors 104 using the program data 124. The operating system 120 may be, for example, Linux, Windows, etc., which includes program instructions for processing basic system services and performing hardware-dependent tasks. The application 122 includes program instructions for implementing various user-desired functions, and the application 122 may be, for example, a browser, instant messaging software, a software development tool (such as an integrated development environment IDE, a compiler, etc.), etc., but is not limited thereto. When the application 122 is installed in the computing device 100, a driver module may be added to the operating system 120.

[0027] When the computing device 100 starts running, the processor 104 reads and executes the program instructions of the operating system 120 from the memory 106. The application 122 runs on the operating system 120 and uses the interfaces provided by the operating system 120 and the underlying hardware to implement various functions desired by the user. When the user starts the application 122, the application 122 is loaded into the memory 106, and the processor 104 reads and executes the program instructions of the application 122 from the memory 106.

[0028] Computing device 100 also includes a storage device 132 including a removable storage 136 and a non-removable storage 138 , both of which are connected to storage interface bus 134 .

[0029] The computing device 100 may also include an interface bus 140 that facilitates communication from various interface devices (e.g., output devices 142, peripheral interfaces 144, and communication devices 146) to the basic configuration 102 via the bus / interface controller 130. Example output devices 142 include a graphics processing unit 148 and an audio processing unit 150. They can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 152. Example peripheral interfaces 144 may include a serial interface controller 154 and a parallel interface controller 156, which may be configured to facilitate communication with external devices such as input devices (e.g., keyboards, mice, pens, voice input devices, touch input devices) or other peripherals (e.g., printers, scanners, etc.) via one or more I / O ports 158. Example communication devices 146 may include a network controller 160, which may be arranged to facilitate communication with one or more other computing devices 162 via a network communication link via one or more communication ports 164.

[0030] A network communication link may be an example of a communication medium. The communication medium may generally be embodied as a computer-readable instruction, data structure, program module in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium. A "modulated data signal" may be a signal in which one or more of its data sets or its changes may be performed in a manner that encodes information in the signal. As a non-limiting example, the communication medium may include a wired medium such as a wired network or a dedicated network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable medium used herein may include both storage media and communication media. In a computing device 100 according to the present invention, the application 122 includes instructions for executing the spyware detection method 200 based on WiFi hotspot traffic analysis of the present invention.

[0031] Figure 2 FIG. 2 is a flow chart of a spyware detection method 200 based on WiFi hotspot traffic analysis according to an embodiment of the present invention. Figure 2 As shown, in step S210, the traffic data of all devices connected to the WiFi hotspot are captured, and the device traffic data are stored in a time series database according to timestamps.

[0032] You can deploy a traffic monitoring module in a WiFi hotspot (such as a router or AP device) and use a deep packet inspection tool (such as Wireshark or tcpdump) or a traffic mirroring tool to capture the network traffic data of all devices in the hotspot in real time. The traffic monitoring module has no direct interaction with user device communications and will not affect user network communications.

[0033] Then, device information, session information and packet feature information are filtered out from the captured network traffic data. Device information includes device IP address and MAC address. Session information includes source IP, destination IP, source port, destination port, and the protocol used (such as HTTP, HTTPS, DNS, etc.). Packet feature information includes packet size (unit: bytes), direction (uplink / downlink), timestamp, time interval between packets, etc. Packet size and time interval are key information for identifying spyware. For example, small and frequent uplink data are usually traffic features of spyware stealing information.

[0034] The network traffic data is stored in a time series database according to the timestamp to facilitate subsequent time series analysis. Each record includes the timestamp, packet size, packet transmission direction, and transmission frequency. Among them, the time series database is a database specifically used to store, manage, and query time series data. Time series data is usually generated at a high frequency, and the time interval between data points may be very small, even at the millisecond level. Through a special storage engine and compression technology, the time series database can efficiently store massive amounts of time series data.

[0035] Then, in step S220, data packet classification and time series analysis are performed on the device traffic data based on the time series database to obtain traffic analysis results.

[0036] The detection of spyware relies on the refined analysis of device traffic data. By using a time series database, the time-related features of a large number of network data packets can be efficiently stored and processed, thereby realizing the classification and time series analysis of traffic. In one embodiment of the present disclosure, the data packets are divided into normal communication traffic and malicious communication traffic based on the data packet feature information. Specifically, the data packets of the traffic data are classified according to the protocol type. For example, the data packets are classified according to the protocol type (HTTP, HTTPS, DNS, SMTP, etc.). Focus on the HTTPS and SMTP protocols that are commonly used to upload data. For each protocol type of data packet, the data packet is marked as uplink or downlink according to the IP address and port, and the number of data packets sent or received in a fixed time window is counted, and the size distribution of each data packet is counted.

[0037] By comparing the traffic characteristics of normal applications, we can find out the abnormal traffic characteristics that do not conform to normal communication behavior, and divide the data packets into normal communication traffic and malicious communication traffic. The traffic characteristics of normal applications are that the data packet size is diversified and the communication frequency is consistent with the application scenario. The abnormal traffic characteristics are that the data packet size is fixed and small, the upstream frequency is higher than the downstream frequency, or the communication port is a non-standard port. For example, the data packet characteristics of normal communication such as web browsing, file transfer, and video streaming are usually large data packets, expected port numbers, and communication modes. Spyware usually uses high-frequency HTTPS communication, tries to use encrypted traffic to hide its stealing behavior, and uses specific ports, such as SMTP587 port, to upload stolen information. Therefore, by comparing the traffic patterns of normal applications, we can find out the traffic that does not conform to normal communication behavior, and divide the data packets into normal communication traffic and malicious communication traffic. For example, social networks usually use port 443, and video traffic has continuous large data packet transmission. If the traffic pattern of a device is significantly different from the normal communication traffic pattern, the traffic of the device may be malicious communication traffic.

[0038] Then, a time series analysis is performed on normal communication traffic and malicious communication traffic. The burst of abnormal traffic is detected based on the timestamp, transmission frequency, packet size and transmission direction of the data packet, and the abnormal traffic that deviates from the normal communication traffic baseline is marked. Among them, time series analysis is mainly used to discover the periodic or fixed interval pattern of traffic. Since spyware usually uploads data periodically, through timestamp and transmission frequency analysis, check whether the traffic is sent frequently at fixed intervals. Since the data stolen by spyware is usually in text format (such as passwords, GPS locations, etc.), the transmission packets are usually small and mostly unidirectional uplink packets. Through the analysis of packet size and transmission direction, small and scattered upload behaviors can be used as traffic characteristics of spyware. Analyze the duration of each session. The session length in normal user behavior is usually consistent with the duration of a certain activity (such as video playback or web browsing), while the spyware sessions are usually short and frequent.

[0039] Finally, in step S230, a comprehensive judgment is made on the traffic analysis results based on the preset rule set to generate a spyware detection report.

[0040] According to an embodiment of the present disclosure, the preset rule set may include: if the proportion of small packets within a preset time exceeds a preset threshold, mark it as suspicious traffic; mark the uploaded data at a fixed interval as abnormal traffic; mark the asymmetric traffic with more upstream traffic than downstream traffic as abnormal traffic; mark the communication of a specific port as suspicious traffic. Each rule has a corresponding priority, and these priorities are combined for weighted scoring in the final judgment.

[0041] Faced with a complex and ever-changing network environment, a single-level traffic detection method is vulnerable to the challenge of hidden malicious behavior. This solution uses a multi-level detection mechanism to combine real-time detection and delayed detection, classifies traffic, and uses network isolation and other means to provide efficient and comprehensive spyware detection.

[0042] In one embodiment of the present disclosure, abnormal traffic and suspicious traffic that conform to a preset rule set can be weighted and scored based on the priority of the rules, and traffic with a score higher than a threshold can be marked as high-risk behavior. Since the behavioral characteristics and severity exhibited by multiple abnormal rules vary significantly, real-time detection can be performed on obviously abnormal traffic. For example, real-time traffic detection focuses on detecting traffic characteristics such as periodic uploading of small data packets, use of abnormal ports for communication, and significantly more upstream traffic than downstream traffic. Delayed detection is used for potential threats that are not urgent, such as low-frequency abnormal behavior that steals small amounts of data but at long intervals, confusing behavior that uses normal communication to cover up malicious behavior, and non-linear upload patterns.

[0043] When high-risk behavior is detected, the device is isolated from communication. For example, the device bandwidth or communication protocol is limited to allow access only to a list of trusted IP addresses. Alternatively, the device is directly connected to the WiFi hotspot. Based on the detected suspicious or abnormal traffic, a detection report is generated, which includes the device's IP address, port number, protocol type, traffic characteristics, behavior description, and action suggestions. For example, a suspicious behavior is described as "uploading small data packets at fixed time intervals." The action suggestion is described as isolating the device and blocking the target IP.

[0044] According to an embodiment of the present disclosure, historical traffic data can be collected, and a detection model based on traffic analysis can be trained based on the historical traffic data and known normal communication patterns to obtain a trained detection model. Abnormal behavior detection can be performed on real-time traffic data based on the trained detection model.

[0045] Figure 3 FIG. 3 is a schematic diagram showing the structure of a spyware detection device 300 based on WiFi hotspot traffic analysis according to an embodiment of the present invention. Figure 3 As shown, the device 300 may include: a capturing module 310 , an analyzing module 320 and a generating module 330 .

[0046] Among them, the capture module 310 can capture the traffic data of all devices connected to the WiFi hotspot, and store the device traffic data in the time series database according to the timestamp. According to one embodiment of the present disclosure, the capture module 310 can deploy a traffic monitoring module in a WiFi hotspot (such as a router, an AP device), and use a deep packet inspection tool (such as Wireshark or tcpdump) or a traffic mirroring tool to capture the network traffic data of all devices in the hotspot in real time. The traffic monitoring module has no direct interaction with the user device communication and will not affect the user's network communication. The network traffic data is stored in the time series database according to the timestamp to facilitate subsequent time series analysis. Each record includes a timestamp, a data packet size, a data packet transmission direction, and a transmission frequency. Among them, the time series database is a database specifically used to store, manage, and query time series data. Time series data is usually generated at a high frequency, and the time interval between data points may be very small, even at the millisecond level. Through a special storage engine and compression technology, the time series database can efficiently store massive amounts of time series data.

[0047] The analysis module 320 can perform data packet classification and time series analysis on the device traffic data based on the time series database to obtain traffic analysis results. According to an embodiment of the present disclosure, the analysis module 320 can classify the data packets into normal communication traffic and malicious communication traffic based on the data packet feature information. Time series analysis is performed on the normal communication traffic and the malicious communication traffic, and the burst of abnormal traffic is detected according to the timestamp, transmission frequency, data packet size and transmission direction of the data packet, and the abnormal traffic that deviates from the normal communication traffic baseline is marked.

[0048] The generation module 330 can make a comprehensive judgment on the traffic analysis results based on the preset rule set and generate a spyware detection report. In one embodiment of the present disclosure, the generation module 330 can perform weighted scoring on abnormal traffic and suspicious traffic that conform to the preset rule set based on the priority of the rules, and mark the traffic with a score higher than the threshold as high-risk behavior. When high-risk behavior is detected, the device is isolated from communication. Based on the detected suspicious traffic or abnormal traffic, a detection report is generated, which includes the device's IP address, port number, protocol type, traffic characteristics, behavior description, and operation suggestions.

[0049] In summary, the present invention can at least achieve the following technical effects: 1. By detecting abnormal behavior of device traffic data and processing different types of traffic in different layers, it can identify high-risk spyware behaviors in real time, continuously monitor potential risks, and promptly detect and block spyware activities; 2. Traffic is captured and analyzed through WiFi hotspots. Users do not need to install additional software or configuration, which does not affect the user experience of the device. It can be used on a variety of devices and operating systems and can be deployed in different WiFi network environments.

[0050] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0051] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative and not restrictive with respect to the scope of the present invention, and the scope of the present invention is defined by the appended claims.

Claims

1. A spyware detection method based on WiFi hotspot traffic analysis, characterized in that: include: Capture traffic data of all devices connected to the WiFi hotspot, and store the device traffic data in a time series database according to timestamps; Based on the time series database, data packet classification and time series analysis are performed on the device traffic data to obtain a traffic analysis result; A comprehensive judgment is made on the traffic analysis results based on a preset rule set to generate a spyware detection report.

2. The spyware detection method based on WiFi hotspot traffic analysis according to claim 1 is characterized in that: The step of capturing the traffic data of all devices connected to the WiFi hotspot and storing the traffic data of the devices in a time series database according to timestamps includes: Capture network traffic data of all devices connected to the WiFi hotspot in real time based on deep packet inspection tools; Filtering device information, session information and data packet characteristic information from the network traffic data, wherein the session information includes source IP, destination IP, source port, destination port and protocol type, and the data packet characteristic information includes timestamp, data packet size, transmission direction and transmission frequency; The network traffic data is stored in a time series database according to timestamps, and each record includes a timestamp, a data packet size, a data packet transmission direction, and a transmission frequency.

3. The spyware detection method based on WiFi hotspot traffic analysis according to claim 2, characterized in that: The step of performing data packet classification and time series analysis on the device traffic data based on the time series database to obtain the traffic analysis result comprises: According to the data packet characteristic information, the data packets are divided into normal communication traffic and malicious communication traffic; A time series analysis is performed on the normal communication traffic and malicious communication traffic, bursts of abnormal traffic are detected based on the timestamp, transmission frequency, data packet size and transmission direction of the data packet, and abnormal traffic that deviates from the normal communication traffic baseline is marked.

4. The spyware detection method based on WiFi hotspot traffic analysis according to claim 3 is characterized in that: The step of classifying the data packets into normal communication traffic and malicious communication traffic according to the data packet characteristic information comprises: Classify the packets of traffic data according to protocol type; For each protocol type of data packet, mark the data packet as uplink or downlink according to the IP address and port, count the number of data packets sent or received within a fixed time window, and count the size distribution of each data packet; By comparing the traffic characteristics of normal applications, abnormal traffic characteristics that do not conform to normal communication behavior are found, and data packets are divided into normal communication traffic and malicious communication traffic. The traffic characteristics of normal applications are that the data packet sizes are diversified and the communication frequency is consistent with the application scenario. The abnormal traffic characteristics are that the data packet size is fixed and small, the upstream frequency is higher than the downstream frequency, or the communication port is a non-standard port.

5. The spyware detection method based on WiFi hotspot traffic analysis according to claim 1, characterized in that: The preset rule set includes: if the proportion of small packets within a preset time exceeds a preset threshold, it is marked as suspicious traffic; the uploaded data at a fixed interval is marked as abnormal traffic; the asymmetric traffic with more upstream traffic than downstream traffic is marked as abnormal traffic; the communication of a specific port is marked as suspicious traffic, and each rule in the preset rule set has a corresponding priority.

6. The spyware detection method based on WiFi hotspot traffic analysis according to claim 5, characterized in that: The step of comprehensively judging the traffic analysis results based on a preset rule set to generate a spyware detection report comprises: Performing weighted scoring on abnormal traffic and suspicious traffic that conform to the preset rule set based on the priority of the rules, and marking traffic with a score higher than a threshold as high-risk behavior; When high-risk behavior is detected, the device is isolated from communication; Based on the detected suspicious traffic or abnormal traffic, a detection report is generated, which includes the device's IP address, port number, protocol type, traffic characteristics, behavior description and operation suggestions.

7. The spyware detection method based on WiFi hotspot traffic analysis according to claim 5, characterized in that: The method further comprises: Collect historical traffic data; Training a detection model based on traffic analysis based on the historical traffic data and a known normal communication mode to obtain a trained detection model; Abnormal behavior prediction is performed on real-time traffic data based on the trained detection model.

8. A spyware detection device based on WiFi hotspot traffic analysis, characterized in that: include: A capture module, used to capture the traffic data of all devices connected to the WiFi hotspot, and store the device traffic data in a time series database according to timestamps; An analysis module, used to perform data packet classification and time series analysis on the device traffic data based on the time series database to obtain a traffic analysis result; The generation module is used to make a comprehensive judgment on the traffic analysis result based on a preset rule set to generate a spyware detection report.

9. A computing device, characterized in that include: At least one processor and a memory storing program instructions, wherein the program instructions are configured to be suitable for being executed by the at least one processor, and the program instructions include instructions for executing the spyware detection method based on WiFi hotspot traffic analysis as described in any one of claims 1-7.

10. A readable storage medium storing program instructions, characterized in that: When the program instructions are read and executed by a computing device, the computing device executes the spyware detection method based on WiFi hotspot traffic analysis as described in any one of claims 1 to 7.

Images