Anti-eavesdropping method for wireless router

Abstract

The invention relates to the technical field of network security and privacy protection, and discloses an anti-eavesdropping method for a wireless router. According to the anti-eavesdropping method for the wireless router, an independent deployment mode is adopted, an optimal defense strategy in a specific traffic state can be learned without any priori knowledge through a zero-knowledge self-evolution learning strategy, the problem of cross-device deployment is effectively solved, in addition, wireless frame camouflage is carried out in multiple dimensions, and the anti-eavesdropping performance of the wireless router is improved. Comprising the steps that a customized operating system kernel and a network card drive are utilized to ensure that a forged frame is consistent with a real frame in protocol specification and logic sequence, and a network card scheduling algorithm is utilized to simulate signal characteristics of the real frame, so that the problem of adaptive injection is solved, the anti-eavesdropping deployment flexibility and defense intelligence of the wireless router are remarkably improved, and the anti-eavesdropping performance of the wireless router is improved. And defense can be efficiently and accurately realized.

Description

Technical Field

[0001] The invention relates to the technical field of network security and privacy protection, and in particular to a method for preventing wireless routers from eavesdropping. Background Art

[0002] IoT devices are widely used in daily life. They are usually connected to the Internet through wireless routers. Although these devices use encrypted communications to improve security, attackers can still identify device behaviors by analyzing the side channel characteristics of wireless data frames triggered by different device behaviors (such as frame length and transmission direction).

[0003] In order to defend against wireless fingerprint attacks, existing research usually adopts two strategies to confuse the side channel traffic characteristics of IoT devices, by padding IP packets to adjust their size and injecting wireless frames of specific size and direction. However, the defense strategy based on packet padding requires firmware modification in IoT devices, so the cost is high, and the injection-based defense strategy also faces challenges, namely how to generate forged frames that adaptively match real wireless frames. Therefore, due to the obstacles of cross-device deployment and the complexity of adaptive injection, existing fingerprint defense methods are difficult to quickly promote and deploy, resulting in IoT devices being continuously exposed to the risk of wireless fingerprint attacks. Summary of the invention

[0004] 1. Technical issues to be resolved In view of the deficiencies in the prior art, the present invention provides a method for preventing wireless routers from eavesdropping, which has the advantages of real-time identification and prediction of device traffic characteristics, and generation of forged frames that match real frames, thereby achieving efficient wireless traffic defense and solving the above problems.

[0005] (II) Technical solution To achieve the above object, the present invention provides the following technical solution: a method for preventing wireless routers from eavesdropping, comprising the following steps: S1. Collect and analyze TCP / IP traffic generated by IoT devices in real time, divide the traffic into multiple packet windows according to device type and protocol, and calculate the traffic rate. S2. In each data packet window, the wireless traffic that the IoT device may send or receive in the future is predicted based on the current TCP / IP traffic, two independent Markov transfer matrices are constructed and the transfer tensor is defined, and finally the defined transfer tensors are spliced ​​into the complete data packet traffic prediction result; S3. Analyze the fingerprint structure based on the traffic prediction results. If a specific fingerprint is identified, select the optimal forged frame generation strategy and execute it. Otherwise, do not take any action. After the identification action is completed, calculate the fingerprint matching rate to evaluate the fingerprint identification success rate. S4, disguise the forged frame generated by the strategy from three dimensions: protocol field, sequence logic and physical signal, and inject it into the network, calculate the injection delay to verify the injection efficiency of the forged frame; S5, using a strategy evaluator to calculate the strategy success rate to evaluate the effect of this frame generation strategy; S6. Store the evaluation results for subsequent strategy learning and optimization.

[0006] Preferably, the calculation formula of the flow rate is as follows:

[0007] In the formula, represents the flow rate, Indicates at time The total number of bytes of data transferred within Indicates time interval. Traffic rate is the amount of data transmitted over the network per unit time and is used to measure the bandwidth performance of the network.

[0008] Preferably, the Markov transfer matrix The transfer tensor definition is as follows:

[0009] in, represents the Markov transition matrix The transfer tensor of represents the conditional probability, that is, at time and At the moment, the transfer matrix is The probability of the state at any moment, Indicates at time Time, dimension and status, Indicates at time Time, dimension and status, Indicates the state that needs to be predicted.

[0010] Preferably, the Markov transfer matrix The transfer tensor definition is as follows:

[0011] in, represents the Markov transition matrix The transfer tensor of represents the conditional probability, that is, at time and At the moment, the transfer matrix is The probability of the state at any moment, Indicates at time Time, dimension status, Indicates at time Time, dimension status, Indicates the state that needs to be predicted.

[0012] Preferably, the Markov transfer matrix The transfer tensor With the Markov transition matrix The transfer tensor After splicing, the complete data packet flow prediction result is obtained.

[0013] Preferably, the fingerprint matching rate calculation formula is as follows:

[0014] In the formula, represents the fingerprint matching rate, Indicates the number of successfully matched fingerprints, Indicates the number of mismatched fingerprints.

[0015] Preferably, the calculation formula for the injection delay is as follows:

[0016] In the formula, Indicates injection delay, Indicates the transmission delay. Indicates processing delay. Indicates queue delay. Indicates the number of packet retransmissions. Indicates the ratio of successfully received packets.

[0017] Preferably, the calculation formula for the success rate of the calculation strategy is as follows:

[0018] In the formula, represents the strategy success rate, represents the number of successful interference events, represents the number of eligible events that were not interfered with, The number of events representing false interference.

[0019] A wireless router anti-eavesdropping system, used to implement the wireless router anti-eavesdropping method in the above embodiment, specifically includes a traffic prediction module, a traffic fingerprint erasing module, a wireless frame camouflage module and a strategy evaluation module; The traffic prediction module is used to predict the wireless data frames sent or received by the device in the future data packet window, and to reserve buffer time for subsequent frame injection; The traffic fingerprint erasing module is used to analyze the fingerprint structure of the predicted traffic, and if a specific fingerprint is identified, the best frame generation strategy is selected to generate a forged frame to erase the traffic fingerprint, otherwise, no action is taken; The wireless frame camouflage module is used to camouflage the forged frame in three dimensions: protocol field, sequence logic and physical signal, so that the forged frame is indistinguishable from the real frame; The strategy evaluation module is used to evaluate the defense effect of the frame generation strategy.

[0020] Preferably, the traffic prediction module learns The packet transfer rules in the Future packets in, first, The packet states in are mapped to the state space ,in Indicates the status of each data packet, is the packet length, is the packet direction, For data packets in The relative time in the packet is defined as The length of the data packet is defined as a positive value for the data packet sent by the device and a negative value for the data packet received. The maximum transmission unit of a data packet is limited. The packet size is set at Inside.

[0021] Compared with the prior art, the present invention provides a method for preventing wireless routers from eavesdropping, which has the following beneficial effects: The present invention adopts an independent deployment mode and a zero-knowledge self-evolution learning strategy. It can learn the optimal defense strategy under a specific traffic state without any prior knowledge, effectively solving the problem of cross-device deployment. In addition, the wireless frame is disguised in multiple dimensions, including using a customized operating system kernel and network card driver to ensure that the forged frame is consistent with the real frame in protocol specifications and logical order, and using a network card scheduling algorithm to simulate the signal characteristics of the real frame, thereby overcoming the problem of adaptive injection, significantly improving the deployment flexibility and defense intelligence of wireless routers against eavesdropping, and being able to achieve defense efficiently and accurately. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a schematic diagram of the steps of the method of the present invention. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] In view of the problem that the existing fingerprint defense methods are difficult to quickly promote and deploy, resulting in the continuous exposure of IoT devices to the risk of wireless fingerprint attacks, a wireless router anti-eavesdropping method is proposed. Figure 1 , including the following steps: S1. Collect and analyze TCP / IP traffic generated by IoT devices in real time, divide the traffic into multiple packet windows according to device type and protocol, and calculate the traffic rate. The wireless router anti-eavesdropping system supports three deployment modes: integrated mode, companion mode, and air mode. According to the characteristics of each deployment mode, the system's data preprocessing is also different. In the integrated mode, the system directly processes the TCP / IP traffic of each device connected to the router, and maps the traffic of specific devices and specific protocols to the corresponding data packet windows. In the companion mode, the system input is the router's export traffic, which does not include the LAN internal communication traffic. By analyzing the external public network IP communicating with the router and the size difference between the TCP / IP data packet and the wireless data frame, the traffic of different devices is distinguished, and PW is divided according to the specific device and specific protocol. In the air mode, the system input is the wireless traffic of each device. After filtering out the management frame and control frame, the data frame of the specific physical address is mapped to the corresponding PW; The flow rate calculation formula is as follows:

[0025] By calculating the traffic rate, the network load can be monitored in real time to help identify whether there is abnormal traffic. For example, a surge in traffic may indicate a potential security threat or attack. In the formula, represents the flow rate, Indicates at time The total number of bytes of data transferred within Indicates a time interval. The traffic rate is the amount of data transmitted over the network per unit time. It is used to measure the bandwidth performance of the network. Rapidly changing traffic rates can be used as a security protection indicator to quickly identify and respond to potential eavesdropping or data leakage. S2. In each data packet window, the wireless traffic that the IoT device may send or receive in the future is predicted based on the current TCP / IP traffic, two independent Markov transfer matrices are constructed and the transfer tensor is defined, and finally the defined transfer tensors are spliced ​​into the complete data packet traffic prediction result; Learning with the Traffic Prediction Module The packet transfer rules in the Future packets in, first, The packet states in are mapped to the state space ,in Indicates the status of each data packet, is the packet length, is the packet direction, For data packets in The relative time in the packet is defined as The length of the data packet is defined as a positive value for the data packet sent by the device and a negative value for the data packet received. The maximum transmission unit of a data packet is limited. The packet size is set at The data packets in the same interval can be regarded as having the same size and direction; Then, two independent Markov transition matrices are constructed, and ,in, Focus on capturing the size and direction of data packets. Focusing on the transition probability of the relative time of the captured packets, and The transfer tensors in are defined as:

[0026] in, represents the Markov transition matrix The transfer tensor of represents the conditional probability, that is, at time and At the moment, the transfer matrix is The probability of the state at any moment, Indicates at time Time, dimension and status, Indicates at time Time, dimension and status, Indicates the state that needs to be predicted.

[0027]

[0028] in, represents the Markov transition matrix The transfer tensor of represents the conditional probability, that is, at time and At the moment, the transfer matrix is The probability of the state at any moment, Indicates at time Time, dimension status, Indicates at time Time, dimension status, Indicates the state that needs to be predicted; Finally, we transfer the tensor and Splice into complete data packet prediction results; S3. Analyze the fingerprint structure based on the traffic prediction results. If a specific fingerprint is identified, select the optimal forged frame generation strategy and execute it. Otherwise, do not take any action. After the identification action is completed, calculate the fingerprint matching rate to evaluate the fingerprint identification success rate. The traffic fingerprint erasing module is used to analyze and predict the fingerprint structure of the traffic. If a specific traffic fingerprint is identified, the optimal forged frame generation strategy is selected and executed. Otherwise, no action is taken. Specifically, the traffic fingerprint erasing module includes two types of frame forgery strategies, namely frame-by-frame forgery and sequence-by-sequence forgery. The two types of frame forgery strategies can be further divided into six types. The first is to inject a single random forged frame. The length and direction of the forged frame are randomly generated, and its sequence number is consistent with the sequence number of the next data frame of the device. The second is to inject a group of random forged frames. The length and direction of the forged frame are randomly generated. The sequence number of the group forged frame is connected to the sequence number of the next data frame of the device. The third is to replay a single forged frame of a non-target device. The length and direction of the forged frame conform to the typical data frame characteristics of the non-target device. The fourth is to replay a forged frame sequence of a non-target device. The length and direction of the forged frame sequence conform to the typical data frame sequence characteristics of the non-target device. The fifth is to clone the current data frame. The length and direction of the forged frame are randomly generated, and the sequence number is consistent with the sequence number of the current data frame. The sixth is sequence deformation. Regardless of the current traffic state, a set of data frame sequences with a preset, fixed length and direction are injected. The fingerprint matching rate calculation formula is as follows:

[0029] By calculating the fingerprint matching rate, we can measure the accuracy of the system in identifying various devices. A high matching rate indicates that the system can effectively distinguish and identify legitimate devices from illegitimate devices, thereby enhancing network security. In the formula, represents the fingerprint matching rate, Indicates the number of successfully matched fingerprints, Indicates the number of mismatched fingerprints. By analyzing historical fingerprint matching rate data, it can effectively evaluate and predict device behavior and provide data support for future security protection decisions; S4, disguise the forged frame generated by the strategy from three dimensions: protocol field, sequence logic and physical signal, and inject it into the network, calculate the injection delay to verify the injection efficiency of the forged frame; By using the wireless frame camouflage module, the forged frame is precisely kept consistent with the real frame in terms of protocol fields, sequence logic and physical signals, so that the forged frame and the real frame are indistinguishable. First, the module adjusts the various protocol fields of the forged frame, such as the frame control field, address field, etc., to ensure that it fully matches the real frame. Secondly, the module captures the serial number of the device's current communication in real time, and flexibly adjusts the serial number of the forged frame through a customized operating system kernel and network card driver, so that it can be seamlessly inserted into the current communication. Finally, the module uses the network card scheduling framework to perceive the physical signal characteristics of the real frame, and uses the optimal scheduling algorithm to match the network card with appropriate power to inject the forged frame. After fine camouflage in three dimensions, the module improves the concealment of the forged frame and makes it indistinguishable from the real frame. The calculation formula for injection delay is as follows:

[0030] Calculating the injection delay can evaluate whether the injection of forged traffic is within an acceptable delay range, which is crucial to effectively interfere with malicious traffic. In the formula, Indicates injection delay, Indicates the transmission delay. Indicates processing delay. Indicates queue delay. Indicates the number of packet retransmissions. Indicates the proportion of successfully received data packets. If the injection delay is too high, the interference strategy can be quickly adjusted according to real-time data, and a more optimized injection scheme can be selected to ensure the flexibility of attack and defense measures; S5, using a strategy evaluator to calculate the strategy success rate to evaluate the effect of this frame generation strategy; The evaluation module is used to evaluate the effectiveness of the frame forgery strategy. The module includes hierarchical feature extraction and multi-scale window classification mechanism. For each time window, the module extracts traffic features from three dimensions: frame level, sequence level, and window level. Frame level: Each independent 802.11 wireless data frame is converted into a data frame vector FV, whose specific attributes include data frame length, direction and time, expressed as ; Sequence level: Multiple consecutive 802.11 wireless data frames are converted into a sequence vector SV, represented as ; Window level: extract statistical features of data frames under the time window, including 11-dimensional features such as total length of data frames and length variance; In order to flexibly capture the traffic characteristics from high-frequency interactive devices to low-frequency communication devices, this module adopts a multi-scale window classifier. Specifically, the traffic in the time window T is further divided into sub-windows of different scales, where the j-th time sub-window of the i-th scale is marked as , each subwindow Both use hierarchical feature extraction and input the extracted features into the random classification classifier. The classification results can be expressed as ,Finally, a weight-based voting strategy is adopted to ,combine the classification results of each sub-window to determine the most likely ,device type in the time window T; The calculation formula of strategy success rate is as follows:

[0031] Based on the calculation of the strategy success rate, the existing protection measures can be quickly adjusted or optimized to improve the overall defense capability and response time. In the formula, represents the strategy success rate, represents the number of successful interference events, represents the number of eligible events that were not interfered with, Indicates the number of events of false interference. Based on the historical data of strategy success rate, it can provide important reference for future security strategy formulation and continuously adjust and improve protection measures; S6, store the evaluation results for subsequent strategy learning and optimization; Based on the existing policy evaluation results, we continuously explore the best mapping from device traffic status to frame forgery strategy, and adopt an advanced reinforcement learning algorithm to effectively handle discrete frame forgery actions. Specifically, the exploration process can be described as a series of decision tuples: , where state S is defined as the initial packet state in PW and the executed frame forgery strategy, action A is defined as the set of all possible frame forgery strategies under state S, and reward R is defined as the immediate feedback obtained by executing action A under state S. Each time a frame forgery strategy is executed, the experience (traffic state, frame forgery action, reward value) is stored in the experience area for the reinforcement learning agent to learn and optimize the strategy.

[0032] Steps S1 to S6 are integrated into a reinforcement learning-based framework to build an iterative optimization strategy process. The framework collects and analyzes IoT device traffic in real time, predicts device behavior, selects and executes the optimal counterfeiting strategy, and continuously optimizes through evaluation feedback to ultimately achieve the best match between traffic status and counterfeiting strategy. A wireless router anti-eavesdropping system can be used to implement the wireless router anti-eavesdropping method in the above embodiment, specifically comprising a traffic prediction module, a traffic fingerprint erasing module, a wireless frame camouflage module and a policy evaluation module.

[0033] The traffic prediction module is used to predict the wireless data frames that may be sent or received by the device within the future data packet window, and reserve buffer time for subsequent frame injection.

[0034] The traffic fingerprint erasing module is used to analyze and predict the fingerprint structure of the traffic. If a specific fingerprint is identified, the best frame generation strategy is selected to generate a forged frame to erase the traffic fingerprint; otherwise, no action is taken.

[0035] The wireless frame camouflage module is used to camouflage forged frames in three dimensions: protocol field, sequence logic and physical signal, so that the forged frames are indistinguishable from the real frames.

[0036] The strategy evaluation module is used to evaluate the defense effect of the frame generation strategy.

[0037] Through the application of the above method, the optimal defense strategy under specific traffic conditions can be learned without any prior knowledge, effectively solving the problem of cross-device deployment. In addition, wireless frames are disguised in multiple dimensions, including using a customized operating system kernel and network card driver to ensure that the forged frames are consistent with the real frames in protocol specifications and logical order, and using the network card scheduling algorithm to simulate the signal characteristics of the real frames, thereby overcoming the problem of adaptive injection, significantly improving the deployment flexibility and defense intelligence of wireless routers against eavesdropping, and being able to achieve defense efficiently and accurately.

[0038] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for preventing wireless routers from eavesdropping, characterized in that: The following steps are involved: S1. Collect and analyze TCP / IP traffic generated by IoT devices in real time, divide the traffic into multiple packet windows according to device type and protocol, and calculate the traffic rate. S2. In each data packet window, the wireless traffic that the IoT device may send or receive in the future is predicted based on the current TCP / IP traffic, two independent Markov transfer matrices are constructed and the transfer tensor is defined, and finally the defined transfer tensors are spliced ​​into the complete data packet traffic prediction result; S3. Analyze the fingerprint structure based on the traffic prediction results. If a specific fingerprint is identified, select the optimal forged frame generation strategy and execute it. Otherwise, do not take any action. After the identification action is completed, calculate the fingerprint matching rate to evaluate the fingerprint identification success rate. S4, disguise the forged frame generated by the strategy from three dimensions: protocol field, sequence logic and physical signal, and inject it into the network, calculate the injection delay to verify the injection efficiency of the forged frame; S5, using a strategy evaluator to calculate the strategy success rate to evaluate the effect of this frame generation strategy; S6. Store the evaluation results for subsequent strategy learning and optimization.

2. A wireless router anti-eavesdropping method according to claim 1, characterized in that: The flow rate calculation formula is as follows: In the formula, represents the flow rate, Indicates at time The total number of bytes of data transferred within Indicates time interval. Traffic rate is the amount of data transmitted over the network per unit time and is used to measure the bandwidth performance of the network.

3. A wireless router anti-eavesdropping method according to claim 2, characterized in that: The Markov transition matrix The transfer tensor definition is as follows: in, represents the Markov transition matrix The transfer tensor of represents the conditional probability, that is, at time and At the moment, the transfer matrix is The probability of the state at any moment, Indicates at time Time, dimension and status, Indicates at time Time, dimension and status, Indicates the state that needs to be predicted.

4. A wireless router anti-eavesdropping method according to claim 3, characterized in that: The Markov transition matrix The transfer tensor definition is as follows: in, represents the Markov transition matrix The transfer tensor of represents the conditional probability, that is, at time and At the moment, the transfer matrix is The probability of the state at any moment, Indicates at time Time, dimension status, Indicates at time Time, dimension status, Indicates the state that needs to be predicted.

5. A wireless router anti-eavesdropping method according to claim 4, characterized in that: The Markov transition matrix The transfer tensor With the Markov transition matrix The transfer tensor After splicing, the complete data packet flow prediction result is obtained.

6. A wireless router anti-eavesdropping method according to claim 5, characterized in that: The fingerprint matching rate calculation formula is as follows: In the formula, represents the fingerprint matching rate, Indicates the number of successfully matched fingerprints, Indicates the number of mismatched fingerprints.

7. A wireless router anti-eavesdropping method according to claim 6, characterized in that: The calculation formula of the injection delay is as follows: In the formula, Indicates injection delay, Indicates the transmission delay. Indicates processing delay. Indicates queue delay. Indicates the number of packet retransmissions. Indicates the ratio of successfully received packets.

8. A wireless router anti-eavesdropping method according to claim 7, characterized in that: The calculation formula for the success rate of the calculation strategy is as follows: In the formula, represents the strategy success rate, represents the number of successful interference events, represents the number of eligible events that were not interfered with, The number of events representing false interference.

9. A wireless router anti-eavesdropping system, used to implement the wireless router anti-eavesdropping method in the above embodiment, characterized in that: It includes traffic prediction module, traffic fingerprint erasure module, wireless frame camouflage module and strategy evaluation module; The traffic prediction module is used to predict the wireless data frames sent or received by the device in the future data packet window, and to reserve buffer time for subsequent frame injection; The traffic fingerprint erasing module is used to analyze the fingerprint structure of the predicted traffic, and if a specific fingerprint is identified, the best frame generation strategy is selected to generate a forged frame to erase the traffic fingerprint, otherwise, no action is taken; The wireless frame camouflage module is used to camouflage the forged frame in three dimensions: protocol field, sequence logic and physical signal, so that the forged frame is indistinguishable from the real frame; The strategy evaluation module is used to evaluate the defense effect of the frame generation strategy.

10. The wireless router anti-eavesdropping system according to claim 9, characterized in that: The traffic prediction module learns The packet transfer rules in the Future packets in, first, The packet states in are mapped to the state space ,in Indicates the status of each data packet, is the packet length, is the packet direction, For data packets in The relative time in the packet is defined as The length of the data packet is defined as a positive value for the data packet sent by the device and a negative value for the data packet received. The maximum transmission unit of a data packet is limited. The packet size is set at Inside.

Images