Method and system for monitoring 4G air interface attack behavior

Abstract

The invention relates to a 4G air interface attack behavior monitoring method and system, and the method comprises the steps: 1, obtaining the information of all existing base stations in a monitoring region, and building a legal base station information feature library; step 2, establishing a 4G air interface attack behavior definition library according to the 4G air interface attack behavior characteristics; and step 3, collecting feature information of all base stations in a monitoring area, matching the feature information with the legal base station information feature library and the 4G air interface attack behavior definition library, and outputting three types of alarm information including attack behavior base station information, unknown behavior base station information and legal base station information change prompts. According to the invention, information feature collection is carried out on air interface signals of all 4G base stations in a monitoring area, monitoring of three types of 4G air interface attack behaviors is realized, tracking analysis is carried out on change conditions of legal base stations, and the problem that near-field air interface signal safety monitoring is lacked for a 4G mobile communication system in a specific area at present is solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of mobile communication security threat monitoring, and in particular relates to a method and system for monitoring 4G air interface attack behavior. Background Art

[0002] Mobile communications are already widely used in daily life. The standardization and openness of air interface communication links, the broadcast characteristics of base stations, and the vast and complex nature of the entire communication network make air interface signals susceptible to detection and interception, leading to attacks such as pseudo-base station attacks: code detection and positioning attacks, interference reduction attacks; "man-in-the-middle" attacks that impersonate legitimate base stations; obtaining plaintext information for mobile phone code detection, positioning, and advertising push. One-way authentication in the 2G era created pseudo-base stations. The use of two-way authentication protocols starting with 3G largely rendered pseudo-base station technology ineffective. However, with the emergence of micro base stations such as 4G home base stations and configuration issues with certain base station nodes in the vast communication network, "man-in-the-middle" attacks exploiting micro base station methods and base station configuration issues can still break through the two-way authentication mechanism. A large number of 2G base stations are still in use, resulting in the presence of interference reduction equipment. Although the 5G communication protocol has been strengthened, it can be reduced to 4G through interference reduction equipment. Devices for mobile phone positioning are also widely used. The 4G network is currently the most widely used mobile communication standard. The security enhancements of 5G still have hidden dangers in the face of interference reduction equipment. Therefore, monitoring attack behaviors against 4G standard air interface signals is of practical significance. Summary of the Invention

[0003] The purpose of the present invention is to provide a method and system for monitoring 4G air interface attack behavior. This technology addresses the information security issues currently existing in the air interface links of 4G mobile communication networks by monitoring 4G air interface signals, analyzing signal characteristics, and monitoring signaling context anomalies. This technology aims to establish a security threat monitoring and protection mechanism for air interface link segments in 4G mobile communication networks. The 4G air interface attack behavior monitoring technology collects air interface signals from all base stations in the monitoring area, extracts parameter characteristics at different levels from signals at different levels, establishes a signal characteristic parameter space, and implements 4G air interface attack behavior monitoring through characteristic data analysis.

[0004] The present invention provides a method for monitoring 4G air interface attack behavior, comprising the following steps:

[0005] Step 1: Obtain information on all currently used base stations in the monitoring area and establish a legal base station information feature database;

[0006] Step 2: Establish a 4G air interface attack behavior definition library based on the characteristics of 4G air interface attack behavior;

[0007] Step 3: Collect the characteristic information of all base stations in the monitoring area and match it with the legal base station information characteristic library and the 4G air interface attack behavior definition library, and output three types of alarm information: attack behavior base station information, unknown behavior base station, and legal base station information change prompt.

[0008] Furthermore, the legal base station information feature library in step 1 includes static information and dynamic information, the static information includes the base station unique ID, the base station country code MCC, the base station operator code MNC, and the base station area code TAC; the dynamic information includes the base station's working frequency list, the working cell list, the reference signal received power RSRP, the signal-to-noise ratio SINR, and the encryption method configured between the base station and the mobile phone.

[0009] Furthermore, the 4G air interface attack behavior definition library in step 2 includes code detection and positioning attack behavior, interference reduction attack behavior, and man-in-the-middle attack behavior.

[0010] Furthermore, the characteristic information collected in step 3 includes static information and dynamic information. The static information includes the base station unique ID, the base station country code MCC, the base station operator code MNC, and the base station area code TAC; the dynamic information includes the base station's working frequency list, the working cell list, the reference signal received power RSRP, the signal-to-noise ratio SINR, the encryption method configured between the base station and the mobile phone, signaling collection, and service data collection.

[0011] Furthermore, the code detection and positioning attack behavior includes IMSI interaction behavior, terminal power request behavior, air interface signal power conversion characteristics, base station power is stronger than surrounding legal base stations, and base station static information is not in the legal base station information feature library; the interference reduction attack behavior includes terminal failure to connect to a legal base station, base station power is stronger than surrounding legal base stations, and base station static information is not in the legal base station information feature library; the man-in-the-middle attack behavior includes IMSI interaction behavior, authentication behavior, clear and secret change behavior, base station power is stronger than surrounding legal base stations, and base station static information may not be in the legal base station information feature library.

[0012] Furthermore, the unknown behavior base station in step 3 indicates that the operator adds a legal base station in the monitoring area, but this type of base station is not included in the legal base station information feature library.

[0013] Furthermore, the legal base station information change prompt in step 3 indicates that the legal base station information stored in the database may be stopped due to the change of the operator, and the coverage adjustment may cause the detection equipment to be unable to detect the existence of such base stations.

[0014] The present invention also provides a 4G air interface attack behavior monitoring system, including a monitoring module, which executes the 4G air interface attack behavior monitoring method.

[0015] The present invention also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are executed by a processor to implement the method for monitoring 4G air interface attack behavior.

[0016] The present invention also provides an electronic device, comprising:

[0017] A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for monitoring 4G air interface attack behavior by executing the computer instructions.

[0018] Through the above solution, through the monitoring method and system of 4G air interface attack behavior, by collecting information characteristics of the air interface signals of all 4G base stations in the monitoring area, three types of 4G air interface attack behaviors are monitored, and changes in legitimate base stations are tracked and analyzed, solving the current problem of lack of near-field air interface signal security monitoring of 4G mobile communication systems in specific areas.

[0019] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention and implement it according to the contents of the specification, the following is a detailed description of the preferred embodiments of the present invention with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 Flowchart of the method for monitoring 4G air interface attack behavior of the present invention;

[0021] Figure 2 This is a monitoring process for 4G air interface attack behavior in one embodiment of the present invention;

[0022] Figure 3 A feature set of a legal base station information database in an embodiment of the present invention;

[0023] Figure 4 This is a diagram defining 4G air interface attack behavior in one embodiment of the present invention;

[0024] Figure 5 Characteristic information collection information of a base station in one embodiment of the present invention;

[0025] Figure 6 The figure is a schematic diagram of an electronic device according to the present invention. DETAILED DESCRIPTION

[0026] The following embodiments of the present invention are described in further detail with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention but are not intended to limit the scope of the present invention.

[0027] Ginseng Figure 1As shown, this embodiment provides a method for monitoring 4G air interface attack behavior, including the following steps:

[0028] Step S1: Obtain information of all currently used base stations in the monitoring area and establish a legal base station information feature database;

[0029] Step S2: establishing a 4G air interface attack behavior definition library based on 4G air interface attack behavior characteristics;

[0030] Step S3: Collect the characteristic information of all base stations in the monitoring area and match it with the legal base station information characteristic library and the 4G air interface attack behavior definition library, and output three types of alarm information: attack behavior base station information, unknown behavior base station, and legal base station information change prompt.

[0031] The present invention is described in further detail below.

[0032] The technical solution for monitoring 4G air interface attack behavior involves pre-modeling the normal base station signals, configuration parameters, and communication behaviors within the monitoring area, and establishing characteristics for abnormal base station communication behavior. Air interface signals from all base stations in the monitoring area are then collected to form a model of each base station's signals, configuration parameters, and communication behavior. These models are then compared with the pre-established normal base station models, and the characteristics are matched against the pre-established abnormal base station communication behaviors. Alerts are issued for base stations whose air interface data deviates from normal base stations, as well as for base stations whose communication behaviors match those of abnormal base stations. Normal base stations also receive alerts if they exhibit abnormal communication behaviors. Base stations that are alerted are categorized based on their matching results: code detection and positioning attack base stations, interference reduction attack base stations, and "man-in-the-middle" attack base stations.

[0033] The monitoring process of 4G air interface attack behavior is as follows: Figure 2 As shown:

[0034] 1) The monitoring method for 4G air interface attack behavior is divided into three stages:

[0035] (1) Preparation stage: Before executing attack behavior monitoring, it is necessary to obtain information on all currently used base stations in the monitored area: it is necessary to communicate with the operator to confirm whether the base station is legal; the information of the base stations confirmed by the operator as legal is stored in the database; and the illegal base stations are contacted with the relevant departments for banning.

[0036] (2) Monitoring phase: 24 / 7 uninterrupted acquisition of all base station information in the monitoring area and static feature matching and base station communication behavior analysis. The analysis results are promptly output as alarms:

[0037] A. The legitimate base station information stored in the "preparation phase" may be stopped due to changes in operators, coverage adjustments, etc., which may cause the detection equipment to be unable to detect the existence of such base stations: a reminder of the change of legitimate base station information;

[0038] B. Operators may add legal base stations to the monitoring area. These base stations are not included in the legal base station information stored in the "preparation phase". The monitoring system will also output an alarm for such base station information: unknown behavior base station;

[0039] C. If a base station meets the requirements of code detection and positioning attack, interference reduction attack, and "man-in-the-middle" communication, then the output is: attacking base station information.

[0040] (3) Confirmation stage: For the three types of alarm outputs, the attacking base station is finally confirmed by professionals and then contacted with the relevant departments for banning; the unknown base station is confirmed by the operator as a newly added legal base station, and the base station information is added to the legal base station information database. If the operator does not add a new base station, the relevant department is contacted for banning; for the legal base station information change alarm, it is necessary to confirm with the operator whether the base station is out of service or moved out of the monitoring area: then the corresponding information will be deleted from the legal base station information database; otherwise, it is necessary to adjust the location of the monitoring equipment or add more monitoring equipment to ensure stable monitoring of the legal base station.

[0041] 2) Establish a legal base station information database

[0042] like Figure 3 As shown in the figure, static and dynamic information is established for the legal base station information database in the monitoring area:

[0043] (1) Static information: This type of information generally does not change after being configured, including the base station unique ID, base station country code MCC, base station operator code MNC, and base station area code TAC;

[0044] (2) Dynamic information: Relevant information may change due to changes in the electromagnetic environment and mobile phone terminals, and it takes a period of time for statistics to stabilize; including: the base station's operating frequency list, the working cell list, the reference signal received power RSRP, the signal-to-noise ratio SINR, and the encryption method configured between the base station and the mobile phone.

[0045] 3) Definition of 4G air interface attack behavior

[0046] like Figure 4 As shown, the common feature of the three attack behaviors is that "the base station power is stronger than the surrounding legitimate base stations";

[0047] "Base station static information not in the legitimate base station information database" is a common feature in "code detection and positioning attacks" and "interference reduction attacks", but it may or may not exist in "man-in-the-middle attacks". This feature is used as a bonus item when matching "man-in-the-middle attack" features.

[0048] "IMSI interaction behavior" has similarities with "code detection and positioning attack behavior" and "man-in-the-middle attack behavior."

[0049] "IMSI interaction behavior": The base station will frequently request the terminal's IMSI; this feature is most obvious in code detection and positioning attacks;

[0050] Terminal power request behavior: To keep approaching the target terminal, the positioning attack will continuously ask the target terminal to report the downlink power of the base station at its location.

[0051] Air interface signal power variation characteristics: Positioning attacks require proximity to the target terminal, and therefore lack the stable power of fixed-location base stations.

[0052] "Base station power is stronger than surrounding legitimate base stations": In order to compete with legitimate base stations for target mobile phones, the attacking device often makes the base station signal of the attacking device stronger than that of the legitimate base station.

[0053] "Base station static information is not in the legitimate base station information database" / "Base station static information may not be in the legitimate base station information database": Most 4G air interface attack devices create base stations that are different from the surrounding legitimate base stations. However, in "man-in-the-middle attacks", they are more likely to impersonate legitimate base stations to launch attacks.

[0054] "Terminals fail to connect to legitimate base stations": The attacking device drives mobile terminals away from legitimate base stations and towards the attacking device's base station, causing a large number of terminals to fail to connect to legitimate base stations.

[0055] "Authentication behavior": After the "man-in-the-middle" attack device "drives" the target mobile terminal to the attack device base station, it will re-authenticate in order to obtain the target mobile phone's information;

[0056] "Change of plaintext to secret text": A "man-in-the-middle" attack device can cause the air interface signal encryption to fail and convert it into plaintext transmission.

[0057] 4) Matching and output of three types of alarm information of base stations within the monitoring area

[0058] The 4G air interface attack behavior monitoring method will match and output three types of alarm information: attack behavior base station information, unknown behavior base stations, and legal base station information change prompts; it is necessary to collect the feature information of all base stations in the monitoring area and then match it with the legal base station information feature library and the 4G air interface attack behavior definition library to finally complete the output.

[0059] The characteristic information content of all base stations in the monitoring area is as follows: Figure 5 As shown:

[0060] Comparison Figure 2 , added two parts: "Signaling Collection" and "Business Data Collection", and the other meanings are the same as Figure 2 consistent.

[0061] (1) 4G air interface signaling collection: To analyze IMSI, authentication, power measurement and other behaviors, it is necessary to collect signaling data for analysis;

[0062] (2) 4G air interface service data collection: "Man-in-the-middle" attacks will exploit the integrity loss vulnerability of IP data in the 4G communication system. Therefore, it is necessary to collect 4G air interface service data for plaintext and ciphertext analysis and comparison.

[0063] The present invention collects static and dynamic features of the air interface signals of all base stations in the monitoring area, performs signaling interaction analysis, and statistically matches them with the preset legal base station information database and 4G air interface attack behavior definition database. It outputs three types of alarm information, including attack behavior base station information, unknown behavior base station, and legal base station information change prompts, thereby achieving the purpose of 4G air interface attack behavior monitoring in the monitoring area.

[0064] The present invention collects static information such as base station ID, MCC, MNC, and TAC of the legal base stations in the monitoring area in advance, and statistically analyzes and collects the working frequency list, working cell list, RSRP, signal-to-noise ratio (SINR), encryption method, etc. of the legal base stations in the monitoring area to complete the legal base station information database; it facilitates the subsequent screening of all base station information in the monitoring area.

[0065] The present invention ensures accurate detection of three types of 4G air interface attack behaviors by defining "code detection and positioning attack behavior", "interference reduction attack behavior" and "man-in-the-middle attack behavior".

[0066] The present invention outputs three types of alarm information within the monitoring area, namely attack behavior base station information, unknown behavior base station information, and legal base station information change prompts, which cover illegal attacks and interference with target base stations, as well as new legal base stations, legal base stations that stop operating or have configuration changes, and can ensure that there are no omissions or false alarms.

[0067] This embodiment further provides a system for monitoring 4G air interface attack behaviors, including a monitoring module, which executes the method for monitoring 4G air interface attack behaviors.

[0068] This embodiment also provides a non-transitory computer-readable storage medium, which stores computer instructions. When the computer instructions are executed by a processor, the method for monitoring 4G air interface attack behavior is implemented.

[0069] Ginseng Figure 6 As shown, this embodiment further provides an electronic device, including:

[0070] The memory 201 and the processor 202 are communicatively connected to each other, the memory 201 stores computer instructions, and the processor 202 executes the method for monitoring 4G air interface attack behavior by executing the computer instructions.

[0071] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for monitoring 4G air interface attack behavior, characterized in that: The steps include: Step 1: Obtain information of all currently used base stations in the monitoring area and establish a legal base station information feature database; Step 2: Establish a 4G air interface attack behavior definition library based on the 4G air interface attack behavior characteristics; Step 3: Collect the characteristic information of all base stations in the monitoring area and match it with the legal base station information characteristic library and the 4G air interface attack behavior definition library, and output three types of alarm information: attack behavior base station information, unknown behavior base station, and legal base station information change prompt.

2. The method for monitoring 4G air interface attack behavior according to claim 1, characterized in that: The legal base station information feature library in step 1 includes static information and dynamic information. The static information includes the base station unique ID, the base station country code MCC, the base station operator code MNC, and the base station area code TAC; the dynamic information includes the base station's working frequency list, working cell list, reference signal received power RSRP, signal-to-noise ratio SINR, and the encryption method configured between the base station and the mobile phone.

3. The method for monitoring 4G air interface attack behavior according to claim 2, characterized in that: The 4G air interface attack behavior definition library described in step 2 includes code detection and positioning attack behavior, interference reduction attack behavior, and man-in-the-middle attack behavior.

4. The method for monitoring 4G air interface attack behavior according to claim 3, characterized in that: The characteristic information collected in step 3 includes static information and dynamic information. The static information includes the base station unique ID, the base station country code MCC, the base station operator code MNC, and the base station area code TAC; the dynamic information includes the base station's working frequency list, working cell list, reference signal received power RSRP, signal-to-noise ratio SINR, encryption method configured between the base station and the mobile phone, signaling collection, and service data collection.

5. The method for monitoring 4G air interface attack behavior according to claim 4, characterized in that: The code detection and positioning attack behaviors include IMSI interaction behaviors, terminal power request behaviors, air interface signal power conversion characteristics, base station power being stronger than surrounding legitimate base stations, and base station static information not being in the legitimate base station information feature library; The interference reduction attack behaviors include the terminal failing to connect to a legitimate base station, the base station power being stronger than the surrounding legitimate base stations, and the base station static information not being in the legitimate base station information feature library; the man-in-the-middle attack behaviors include IMSI interaction, authentication, plaintext and password changes, the base station power being stronger than the surrounding legitimate base stations, and the base station static information may not be in the legitimate base station information feature library.

6. The method for monitoring 4G air interface attack behavior according to claim 5, characterized in that: The unknown behavior base station described in step 3 indicates that the operator adds a legal base station in the monitoring area, and this type of base station is not included in the legal base station information feature library.

7. The method for monitoring 4G air interface attack behavior according to claim 6, characterized in that: The legal base station information change prompt in step 3 indicates that the legal base station information stored in the database may be stopped due to the change of the operator, and the coverage adjustment may cause the detection equipment to be unable to detect the existence of such base stations.

8. A 4G air interface attack behavior monitoring system, characterized in that: It includes a monitoring module, and the monitoring module executes a monitoring method for 4G air interface attack behavior as described in any one of claims 1-7.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, and when the computer instructions are executed by the processor, a method for monitoring 4G air interface attack behavior as described in any one of claims 1-7 is implemented.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for monitoring 4G air interface attack behavior as described in any one of claims 1 to 7 by executing the computer instructions.

Images