Wireless network management method and device, electronic device and computer storage medium

Abstract

The embodiment of the invention provides a wireless network management method and device, an electronic device and a computer readable storage medium, and relates to the technical field of wireless networks, and the method comprises the steps: monitoring equipment detects a current physical layer feature after obtaining the current physical layer feature of a wireless network at a current moment, and determines whether an abnormal feature exists or not; and if the abnormal feature exists, triggering an abnormal alarm, and performing abnormal elimination processing on the terminal equipment corresponding to the abnormal feature. Since the physical layer features are difficult to counterfeit, the security of the wireless network can be effectively improved by detecting the network intrusion through the physical layer features of the wireless network, and various types of network intrusion behaviors are prevented.

Description

Technical Field

[0001] The present invention relates to the field of wireless network technology, and in particular to a wireless network management method, a wireless network management device, an electronic device and a computer-readable storage medium. Background Art

[0002] With the rapid development of wireless network technology, Wi-Fi networks have become an indispensable part of daily life and work. However, the openness and easy accessibility of Wi-Fi networks also expose them to many security threats, such as unauthorized access, data theft, and denial of service attacks.

[0003] Traditional intrusion detection systems have certain limitations in detection efficiency and accuracy. Therefore, it is particularly important to develop an efficient Wi-Fi network intrusion detection and defense system. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a wireless network management method, a wireless network management device, an electronic device and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0005] An embodiment of the present invention discloses a method for managing a wireless network, the method comprising:

[0006] Obtaining current physical layer characteristics of the wireless network at the current moment;

[0007] Detecting the current physical layer feature to determine whether there is an abnormal feature;

[0008] If there are abnormal features, an abnormal alarm is triggered, and abnormal clearing processing is performed on the terminal device corresponding to the abnormal features.

[0009] In one or more embodiments, the obtaining of current physical layer characteristics of the wireless network at the current moment includes:

[0010] Obtain a received signal strength indication, spectrum characteristics, signal timing characteristics, and modulation characteristics of the wireless network at the current moment.

[0011] In one or more embodiments, detecting the current physical layer feature to determine whether there is an abnormal feature includes:

[0012] The current physical layer features are detected by using a preset normal feature model to determine whether there are abnormal features in the current physical layer features.

[0013] In one or more embodiments, the normal feature model is generated by:

[0014] Acquire historical physical layer characteristics of the wireless network in a normal state;

[0015] The historical physical layer characteristics are modeled using a preset statistical method and rule definition to obtain a normal characteristic model.

[0016] In one or more embodiments, performing abnormality clearing processing on the terminal device corresponding to the abnormal feature includes:

[0017] Signals of the terminal device corresponding to the abnormal feature are blocked so that the terminal device is disconnected from the wireless network.

[0018] In one or more embodiments, further comprising:

[0019] Generating a processing record of the abnormality clearing process;

[0020] When the preset evaluation conditions are met, the detection capability is evaluated based on the processing record to obtain an evaluation result;

[0021] The preset normal feature model is updated based on the evaluation result to obtain an updated normal feature model.

[0022] In one or more embodiments, further comprising:

[0023] The current physical layer characteristics, the abnormal characteristics and the abnormal alarm are visually displayed.

[0024] Accordingly, an embodiment of the present invention discloses a wireless network management device, the device comprising:

[0025] An acquisition module, used to acquire current physical layer characteristics of the wireless network at the current moment;

[0026] A detection module, used to detect the current physical layer characteristics to determine whether there are abnormal characteristics;

[0027] The alarm module is used to trigger an abnormal alarm if there are abnormal features, and perform abnormal clearing processing on the terminal device corresponding to the abnormal features.

[0028] In one or more embodiments, the acquisition module is specifically used to:

[0029] Obtain a received signal strength indication, spectrum characteristics, signal timing characteristics, and modulation characteristics of the wireless network at the current moment.

[0030] In one or more embodiments, the detection module is specifically used to:

[0031] The current physical layer features are detected by using a preset normal feature model to determine whether there are abnormal features in the current physical layer features.

[0032] In one or more embodiments, a first generating module is further included, which is specifically configured to:

[0033] Acquire historical physical layer characteristics of the wireless network in a normal state;

[0034] The historical physical layer characteristics are modeled using a preset statistical method and rule definition to obtain a normal characteristic model.

[0035] In one or more embodiments, the alarm module is specifically used to:

[0036] Signals of the terminal device corresponding to the abnormal feature are blocked so that the terminal device is disconnected from the wireless network.

[0037] In one or more embodiments, further comprising:

[0038] A second generating module is used to generate a processing record of the abnormality clearing process;

[0039] An evaluation module, used to evaluate the detection capability based on the processing record and obtain an evaluation result when a preset evaluation condition is met;

[0040] An updating module is used to update the preset normal feature model based on the evaluation result to obtain an updated normal feature model.

[0041] In one or more embodiments, further comprising:

[0042] The display module is used to visually display the current physical layer characteristics, the abnormal characteristics and the abnormal alarm.

[0043] Accordingly, an embodiment of the present invention discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the various steps of the above-mentioned wireless network management method embodiment when executed by the processor.

[0044] Accordingly, an embodiment of the present invention discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each step of the above-mentioned wireless network management method embodiment is implemented.

[0045] The embodiments of the present invention include the following advantages:

[0046] After obtaining the current physical layer characteristics of the wireless network at the current moment, the monitoring device detects the current physical layer characteristics to determine whether there are abnormal characteristics; if there are abnormal characteristics, an abnormal alarm is triggered, and the terminal device corresponding to the abnormal characteristics is cleared. Since physical layer characteristics are difficult to forge, detecting network intrusions through the physical layer characteristics of wireless networks can effectively improve the security of wireless networks and prevent various types of network intrusions. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flowchart of the steps of Embodiment 1 of a wireless network management method of the present invention;

[0048] Figure 2 It is a topological structure diagram of the monitoring device, network device and terminal device of the present invention;

[0049] Figure 3 It is a flow chart of steps of a second embodiment of a wireless network management method of the present invention;

[0050] Figure 4 is a flowchart of the steps of Embodiment 3 of a wireless network management method of the present invention;

[0051] Figure 5 It is a structural block diagram of an embodiment of a wireless network management device of the present invention. DETAILED DESCRIPTION

[0052] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0053] Reference Figure 1 , showing a flow chart of the steps of a wireless network management method embodiment 1 of the present invention, which can be applied to monitoring equipment, referring to Figure 2 , shows a topological structure diagram of monitoring equipment, network equipment and terminal equipment, wherein the monitoring equipment, network equipment and terminal equipment can form a wireless network, such as a Wi-Fi network, and the monitoring equipment can be deployed between the network equipment (such as a router) and the terminal equipment. The monitoring equipment can monitor the data interaction between the network equipment and the terminal equipment, detect abnormal features, and process the abnormal features.

[0054] It should be noted that the number of terminal devices can be one or more, and the embodiment of the present invention is described in detail with the number of terminal devices as one. In practical applications, the specific number of terminal devices can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0055] Furthermore, the monitoring device can be a wireless sensor and a monitoring probe, which can ensure that the collection frequency and range cover the entire network, or it can be other devices. In actual applications, the specific equipment of the monitoring device can also be set according to actual needs, and the embodiments of the present invention do not limit this.

[0056] The method may specifically include the following steps:

[0057] Step 101: Acquire current physical layer characteristics of the wireless network at the current moment.

[0058] Since physical layer characteristics are difficult to forge in a wireless network, detection based on physical layer characteristics can provide higher security. Therefore, in an embodiment of the present invention, the monitoring device can collect the physical layer characteristics of the wireless network at the current moment in real time (for ease of description, recorded as "current physical layer characteristics").

[0059] In the embodiment of the present invention, the obtaining of the current physical layer characteristics of the wireless network at the current moment includes:

[0060] Obtain a received signal strength indication, spectrum characteristics, signal timing characteristics, and modulation characteristics of the wireless network at the current moment.

[0061] Specifically, the monitoring device can obtain the received signal strength indication (RSSI, Received Signal Strength Indication), spectrum characteristics, signal timing characteristics and modulation characteristics of the wireless network at the current moment in real time as the current physical layer characteristics.

[0062] Among them, the received signal strength indication, an optional part of the wireless transmission layer, is used to determine the link quality and whether to increase the broadcast transmission strength. Its implementation is performed after the reverse channel baseband receiving filter. In order to obtain the characteristics of the reverse signal, the following processing is done in the specific implementation of RSSI: the baseband IQ power is integrated within 104us to obtain the instantaneous value of RSSI; then the 8192 RSSI instantaneous values ​​are averaged within about 1 second to obtain the average value of RSSI, that is, RSSI (average) = sum (RSSI (instantaneous)) / 8192, and the maximum value of the RSSI instantaneous value within 1 second and the ratio of the RSSI instantaneous value greater than a certain threshold (the number of RSSI instantaneous values ​​greater than a certain threshold / 8192) are given at the same time. Since RSSI is obtained by integrating power in the digital domain and then inferring it to the antenna port, the inconsistency of the reverse channel signal transmission characteristics will affect the accuracy of RSSI.

[0063] The most important means of judging interference is to look at the average value of RSSI under no-load. For a new start-up, there are few users, and the RSSI level under no-load is generally less than -105dBm. When there are services, the RSSI average value will generally not exceed -95dBm when there are multiple services. The reception quality FER can also be used as a reference to judge whether there is interference. By finding out whether there is interference caused by cross-area coverage, you can also judge whether there is interference from Ec / Io and the received power of the mobile phone. For external interference, the spectrum analyzer can be used to further find out whether there is an interference source.

[0064] Spectral characteristics may include spectrum width and center frequency.

[0065] Spectrum is the abbreviation of frequency spectrum density, which is the distribution curve of frequency. Complex oscillations are decomposed into harmonic oscillations with different amplitudes and frequencies. The graph of the amplitudes of these harmonic oscillations arranged by frequency is called a spectrum. Spectrum is widely used in optics and radio technology. Spectrum introduces the study of signals from the time domain to the frequency domain, thus bringing a more intuitive understanding. The spectrum decomposed into complex mechanical vibrations is called the mechanical vibration spectrum, the spectrum decomposed into acoustic vibrations is called the acoustic spectrum, the spectrum decomposed into light vibrations is called the spectrum, and the spectrum decomposed into electromagnetic vibrations is called the electromagnetic spectrum. The spectrum is generally included in the range of the electromagnetic spectrum. Analyzing the spectrum of various vibrations can understand many basic properties of the complex vibrations, so spectrum analysis has become a basic method for analyzing various complex vibrations. The spectrum width can be the frequency width between the two upper half maximum intensity points on the distribution curve.

[0066] The center frequency is usually defined as the geometric mean of the bandpass filter (or bandstop filter) frequency. In logarithmic coordinates, it is the midpoint between two 3dB points, and is generally expressed as the arithmetic mean of the two 3dB points. The frequency in the middle of the filter passband is based on the center frequency. The frequency higher than the center frequency until the frequency voltage decays to 0.707 times is the upper side frequency, and the opposite is the lower side frequency. The frequency between the upper and lower side frequencies is the passband.

[0067] Signal timing characteristics may include signal arrival time and signal interval. The signal arrival time may be the time it takes for a signal to arrive at a destination. The signal interval may be the time interval between consecutive signals.

[0068] Modulation characteristics may include modulation scheme and symbol rate.

[0069] In order to ensure the communication effect and overcome the problems in long-distance signal transmission, it is necessary to move the signal spectrum to a high-frequency channel for transmission through modulation. This process of loading the signal to be sent into a high-frequency signal is called modulation. In practical applications, whether it is an analog signal or a digital signal, there are usually three most basic modulation methods: amplitude modulation (ASK), frequency modulation (FSK) and phase modulation (PSK). Various other modulation methods are improvements or combinations of the above methods. For example, quadrature amplitude modulation QAM is a combination of amplitude modulation and phase modulation; minimum shift keying MSK is an improvement of FSK; Gaussian filtered minimum shift keying GMSK is an improvement of MSK, which inserts a Gaussian low-pass pre-modulation filter before the MSK modulator, thereby improving spectrum utilization and communication quality; orthogonal frequency division multiplexing modulation OFDM can be regarded as a modulation method for multiple carriers.

[0070] The data after channel coding and interleaving is called symbol, and the flow of symbols per unit time is called symbol rate. After channel coding, a lot of redundant information is added, and one bit corresponds to one symbol (determined by the coding efficiency), so the symbol rate is equal to the bit rate multiplied by the number of symbols corresponding to each bit, which is also equal to the bit rate divided by the coding efficiency.

[0071] It should be noted that, in addition to the above-mentioned indicators, the physical layer characteristics may also include other indicators. In practical applications, the specific indicators of the physical layer characteristics may be set according to actual needs, and the embodiments of the present invention do not limit this.

[0072] Furthermore, since some network devices, such as routers or access points (APs), have the ability to monitor and record physical layer characteristics, these network devices can provide relevant data through SNMP (Simple Network Management Protocol), Syslog or a proprietary management interface. Therefore, in addition to being collected by the monitoring device itself, the current physical layer characteristics can also be obtained from the network device by the monitoring device. In addition, sometimes software tools can be used to collect physical layer characteristic data. These tools can be run on ordinary computers or mobile devices, so the monitoring device can also obtain them from the computer or mobile device. Of course, the current physical layer characteristics can also be obtained by other means. In actual applications, the specific collection method of the current physical layer characteristics can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0073] Step 102: Detect the current physical layer characteristics to determine whether there are abnormal characteristics.

[0074] After obtaining the current physical layer characteristics, the monitoring device can detect whether there are abnormal characteristics in the current physical layer characteristics. If there are abnormal characteristics, it means that there are terminal devices with abnormal connections among the terminal devices connected to the wireless network; if there are no abnormal characteristics, it means that the terminal devices connected to the wireless network are all connected normally.

[0075] In the embodiment of the present invention, the detecting the current physical layer feature to determine whether there is an abnormal feature includes:

[0076] The current physical layer features are detected by using a preset normal feature model to determine whether there are abnormal features in the current physical layer features.

[0077] Specifically, the generated normal feature model can be used to detect the current physical layer feature, so as to determine whether there are abnormal features in the current physical layer feature. Among them, the normal feature model is used to describe the distribution and behavior of the physical layer feature under normal operating conditions. The normal feature model can include the normal range of various indicators. If the value of an indicator in the current physical layer feature exceeds the normal range, then it means that the indicator is abnormal. For example, assuming that the normal range of RSSI is [-70dBm, -30dBm], and the value of RSSI in the current physical layer feature is -80dBm, then the RSSI in the current physical layer feature is an abnormal feature.

[0078] Further, after obtaining the current physical layer characteristics, the current physical layer characteristics can be preprocessed to obtain the preprocessed physical layer characteristics, and then the preprocessed physical layer characteristics are detected. Preprocessing includes but is not limited to data deduplication, data conversion, and data extraction. In actual applications, whether the current physical layer characteristics need to be preprocessed, and the specific method of preprocessing can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0079] In the embodiment of the present invention, the normal feature model is generated in the following manner:

[0080] Acquire historical physical layer characteristics of the wireless network in a normal state;

[0081] The historical physical layer characteristics are modeled using a preset statistical method and rule definition to obtain a normal characteristic model.

[0082] Specifically, when the wireless network is in a normal state (that is, all connected terminal devices in the wireless network are connected normally), the physical layer characteristics (referred to as "historical physical layer characteristics") are obtained, and then the historical physical layer characteristics are modeled using preset statistical methods and rule definitions to obtain a normal characteristic model.

[0083] Among them, the statistical method can adopt methods such as mean, variance, standard deviation, etc., and the rule definition can define the normal range of the feature and the abnormal judgment rule. In practical applications, the specific statistical method and rule definition can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0084] Further, after obtaining the historical physical layer features, the historical physical layer features can be preprocessed to obtain the preprocessed historical physical layer features, and then the processed historical physical layer features can be modeled. The preprocessing may include removing outliers or other processing. In practical applications, whether preprocessing is required and the specific processing method of preprocessing can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0085] Step 103: If there are abnormal features, an abnormal alarm is triggered, and abnormal clearing processing is performed on the terminal device corresponding to the abnormal features.

[0086] If an abnormal feature is detected, an abnormal alarm can be triggered to notify the user, and the terminal device corresponding to the abnormal feature can be cleared, thereby improving the security of the wireless network.

[0087] In the embodiment of the present invention, the abnormality clearing process for the terminal device corresponding to the abnormal feature includes:

[0088] Signals of the terminal device corresponding to the abnormal feature are blocked so that the terminal device is disconnected from the wireless network.

[0089] Specifically, since the monitoring device is deployed between the network device and the terminal device, after detecting an abnormal feature, the monitoring device can block the signal of the terminal device corresponding to the abnormal feature, thereby disconnecting the terminal device from the wireless network.

[0090] In the embodiment of the present invention, after obtaining the current physical layer characteristics of the wireless network at the current moment, the monitoring device detects the current physical layer characteristics to determine whether there are abnormal characteristics; if there are abnormal characteristics, an abnormal alarm is triggered, and the terminal device corresponding to the abnormal characteristics is cleared. Since the physical layer characteristics are difficult to forge, detecting network intrusions through the physical layer characteristics of the wireless network can effectively improve the security of the wireless network and prevent various types of network intrusions.

[0091] Reference Figure 3 , shows a flowchart of a second embodiment of a wireless network management method of the present invention, which may specifically include the following steps:

[0092] Step 301: Acquire current physical layer characteristics of the wireless network at the current moment.

[0093] Since physical layer characteristics are difficult to forge in a wireless network, detection based on physical layer characteristics can provide higher security. Therefore, in an embodiment of the present invention, the monitoring device can collect the current physical layer characteristics of the wireless network at the current moment in real time.

[0094] In the embodiment of the present invention, the obtaining of the current physical layer characteristics of the wireless network at the current moment includes:

[0095] Obtain a received signal strength indication, spectrum characteristics, signal timing characteristics, and modulation characteristics of the wireless network at the current moment.

[0096] Specifically, the monitoring device can obtain in real time the received signal strength indication, spectrum characteristics, signal timing characteristics and modulation characteristics of the wireless network at the current moment as the current physical layer characteristics.

[0097] Among them, the received signal strength indication, an optional part of the wireless transmission layer, is used to determine the link quality and whether to increase the broadcast transmission strength. Its implementation is performed after the reverse channel baseband receiving filter. In order to obtain the characteristics of the reverse signal, the following processing is done in the specific implementation of RSSI: the baseband IQ power is integrated within 104us to obtain the instantaneous value of RSSI; then the 8192 RSSI instantaneous values ​​are averaged within about 1 second to obtain the average value of RSSI, that is, RSSI (average) = sum (RSSI (instantaneous)) / 8192, and the maximum value of the RSSI instantaneous value within 1 second and the ratio of the RSSI instantaneous value greater than a certain threshold (the number of RSSI instantaneous values ​​greater than a certain threshold / 8192) are given at the same time. Since RSSI is obtained by integrating power in the digital domain and then inferring it to the antenna port, the inconsistency of the reverse channel signal transmission characteristics will affect the accuracy of RSSI.

[0098] The most important means of judging interference is to look at the average value of RSSI under no-load. For a new start-up, there are few users, and the RSSI level under no-load is generally less than -105dBm. When there are services, the RSSI average value will generally not exceed -95dBm when there are multiple services. The reception quality FER can also be used as a reference to judge whether there is interference. By finding out whether there is interference caused by cross-area coverage, you can also judge whether there is interference from Ec / Io and the received power of the mobile phone. For external interference, the spectrum analyzer can be used to further find out whether there is an interference source.

[0099] Spectral characteristics may include spectrum width and center frequency.

[0100] Spectrum is the abbreviation of frequency spectrum density, which is the distribution curve of frequency. Complex oscillations are decomposed into harmonic oscillations with different amplitudes and frequencies. The graph of the amplitudes of these harmonic oscillations arranged by frequency is called a spectrum. Spectrum is widely used in optics and radio technology. Spectrum introduces the study of signals from the time domain to the frequency domain, thus bringing a more intuitive understanding. The spectrum decomposed into complex mechanical vibrations is called the mechanical vibration spectrum, the spectrum decomposed into acoustic vibrations is called the acoustic spectrum, the spectrum decomposed into light vibrations is called the spectrum, and the spectrum decomposed into electromagnetic vibrations is called the electromagnetic spectrum. The spectrum is generally included in the range of the electromagnetic spectrum. Analyzing the spectrum of various vibrations can understand many basic properties of the complex vibrations, so spectrum analysis has become a basic method for analyzing various complex vibrations. The spectrum width can be the frequency width between the two upper half maximum intensity points on the distribution curve.

[0101] The center frequency is usually defined as the geometric mean of the bandpass filter (or bandstop filter) frequency. In logarithmic coordinates, it is the midpoint between two 3dB points, and is generally expressed as the arithmetic mean of the two 3dB points. The frequency in the middle of the filter passband is based on the center frequency. The frequency higher than the center frequency until the frequency voltage decays to 0.707 times is the upper side frequency, and the opposite is the lower side frequency. The frequency between the upper and lower side frequencies is the passband.

[0102] Signal timing characteristics may include signal arrival time and signal interval. The signal arrival time may be the time it takes for a signal to arrive at a destination. The signal interval may be the time interval between consecutive signals.

[0103] Modulation characteristics may include modulation scheme and symbol rate.

[0104] In order to ensure the communication effect and overcome the problems in long-distance signal transmission, it is necessary to move the signal spectrum to a high-frequency channel for transmission through modulation. This process of loading the signal to be sent into a high-frequency signal is called modulation. In practical applications, whether it is an analog signal or a digital signal, there are usually three most basic modulation methods: amplitude modulation (ASK), frequency modulation (FSK) and phase modulation (PSK). Various other modulation methods are improvements or combinations of the above methods. For example, quadrature amplitude modulation QAM is a combination of amplitude modulation and phase modulation; minimum shift keying MSK is an improvement of FSK; Gaussian filtered minimum shift keying GMSK is an improvement of MSK, which inserts a Gaussian low-pass pre-modulation filter before the MSK modulator, thereby improving spectrum utilization and communication quality; orthogonal frequency division multiplexing modulation OFDM can be regarded as a modulation method for multiple carriers.

[0105] The data after channel coding and interleaving is called symbol, and the flow of symbols per unit time is called symbol rate. After channel coding, a lot of redundant information is added, and one bit corresponds to one symbol (determined by the coding efficiency), so the symbol rate is equal to the bit rate multiplied by the number of symbols corresponding to each bit, which is also equal to the bit rate divided by the coding efficiency.

[0106] It should be noted that, in addition to the above-mentioned indicators, the physical layer characteristics may also include other indicators. In practical applications, the specific indicators of the physical layer characteristics may be set according to actual needs, and the embodiments of the present invention do not limit this.

[0107] Furthermore, since some network devices, such as routers or access points (APs), have the ability to monitor and record physical layer characteristics, these network devices can provide relevant data through SNMP (Simple Network Management Protocol), Syslog or a proprietary management interface. Therefore, in addition to being collected by the monitoring device itself, the current physical layer characteristics can also be obtained from the network device by the monitoring device. In addition, sometimes software tools can be used to collect physical layer characteristic data. These tools can be run on ordinary computers or mobile devices, so the monitoring device can also obtain them from the computer or mobile device. Of course, the current physical layer characteristics can also be obtained by other means. In actual applications, the specific collection method of the current physical layer characteristics can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0108] Step 102: Detect the current physical layer characteristics to determine whether there are abnormal characteristics.

[0109] After obtaining the current physical layer characteristics, the monitoring device can detect whether there are abnormal characteristics in the current physical layer characteristics. If there are abnormal characteristics, it means that there are terminal devices with abnormal connections among the terminal devices connected to the wireless network; if there are no abnormal characteristics, it means that the terminal devices connected to the wireless network are all connected normally.

[0110] In the embodiment of the present invention, the detecting the current physical layer feature to determine whether there is an abnormal feature includes:

[0111] The current physical layer features are detected by using a preset normal feature model to determine whether there are abnormal features in the current physical layer features.

[0112] Specifically, the generated normal feature model can be used to detect the current physical layer feature, so as to determine whether there are abnormal features in the current physical layer feature. Among them, the normal feature model is used to describe the distribution and behavior of the physical layer feature under normal operating conditions. The normal feature model can include the normal range of various indicators. If the value of an indicator in the current physical layer feature exceeds the normal range, then it means that the indicator is abnormal. For example, assuming that the normal range of RSSI is [-70dBm, -30dBm], and the value of RSSI in the current physical layer feature is -80dBm, then the RSSI in the current physical layer feature is an abnormal feature.

[0113] Further, after obtaining the current physical layer characteristics, the current physical layer characteristics can be preprocessed to obtain the preprocessed physical layer characteristics, and then the preprocessed physical layer characteristics are detected. Preprocessing includes but is not limited to data deduplication, data conversion, and data extraction. In actual applications, whether the current physical layer characteristics need to be preprocessed, and the specific method of preprocessing can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0114] In the embodiment of the present invention, the normal feature model is generated in the following manner:

[0115] Acquire historical physical layer characteristics of the wireless network in a normal state;

[0116] The historical physical layer characteristics are modeled using a preset statistical method and rule definition to obtain a normal characteristic model.

[0117] Specifically, when the wireless network is in a normal state (that is, the connected terminal devices in the wireless network are all connected normally), historical physical layer characteristics are obtained, and then the historical physical layer characteristics are modeled using preset statistical methods and rule definitions to obtain a normal characteristic model.

[0118] Among them, the statistical method can adopt methods such as mean, variance, standard deviation, etc., and the rule definition can define the normal range of the feature and the abnormal judgment rule. In practical applications, the specific statistical method and rule definition can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0119] Further, after obtaining the historical physical layer features, the historical physical layer features can be preprocessed to obtain the preprocessed historical physical layer features, and then the processed historical physical layer features can be modeled. The preprocessing may include removing outliers or other processing. In practical applications, whether preprocessing is required and the specific processing method of preprocessing can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0120] Step 103: If there are abnormal features, an abnormal alarm is triggered, and abnormal clearing processing is performed on the terminal device corresponding to the abnormal features.

[0121] If an abnormal feature is detected, an abnormal alarm can be triggered to notify the user, and the terminal device corresponding to the abnormal feature can be cleared, thereby improving the security of the wireless network.

[0122] In the embodiment of the present invention, the abnormality clearing process for the terminal device corresponding to the abnormal feature includes:

[0123] Signals of the terminal device corresponding to the abnormal feature are blocked so that the terminal device is disconnected from the wireless network.

[0124] Specifically, since the monitoring device is deployed between the network device and the terminal device, after detecting an abnormal feature, the monitoring device can block the signal of the terminal device corresponding to the abnormal feature, thereby disconnecting the terminal device from the wireless network.

[0125] Step 304: Generate a processing record of the abnormality clearing process.

[0126] Step 305: When the preset evaluation conditions are met, the detection capability is evaluated based on the processing record to obtain an evaluation result.

[0127] Step 306: Update the preset normal feature model based on the evaluation result to obtain an updated normal feature model.

[0128] Specifically, after the monitoring device completes the abnormality clearing process for the abnormal feature, it can generate a processing record of the abnormality clearing process for easy storage, browsing and subsequent evaluation.

[0129] When the preset evaluation conditions are met, the stored processing records can be obtained and evaluated to determine the detection capability of the monitoring device, thereby obtaining the evaluation results of the detection capability. Then, the normal feature model can be updated according to the evaluation results, for example, the thresholds of various parameters can be adjusted to obtain an updated normal feature model, thereby improving the detection capability of the normal feature model and further improving the security of the wireless network.

[0130] In the embodiment of the present invention, after obtaining the current physical layer characteristics of the wireless network at the current moment, the monitoring device detects the current physical layer characteristics to determine whether there are abnormal characteristics; if there are abnormal characteristics, an abnormal alarm is triggered, and the terminal device corresponding to the abnormal characteristics is cleared. Since the physical layer characteristics are difficult to forge, detecting network intrusions through the physical layer characteristics of the wireless network can effectively improve the security of the wireless network and prevent various types of network intrusions.

[0131] Furthermore, after the exception clearing process is completed, a processing record of the exception clearing process can be generated, and the normal feature model can be updated according to the processing record to obtain an updated normal feature model, thereby improving the detection capability of the normal feature model and further improving the security of the wireless network.

[0132] Reference Figure 4 , shows a flowchart of a third embodiment of a wireless network management method of the present invention, which may specifically include the following steps:

[0133] Step 401: Acquire current physical layer characteristics of the wireless network at the current moment.

[0134] Since physical layer characteristics are difficult to forge in a wireless network, detection based on physical layer characteristics can provide higher security. Therefore, in an embodiment of the present invention, the monitoring device can collect the physical layer characteristics of the wireless network at the current moment in real time (for ease of description, recorded as "current physical layer characteristics").

[0135] In the embodiment of the present invention, the obtaining of the current physical layer characteristics of the wireless network at the current moment includes:

[0136] Obtain a received signal strength indication, spectrum characteristics, signal timing characteristics, and modulation characteristics of the wireless network at the current moment.

[0137] Specifically, the monitoring device can obtain the received signal strength indication (RSSI, Received Signal Strength Indication), spectrum characteristics, signal timing characteristics and modulation characteristics of the wireless network at the current moment in real time as the current physical layer characteristics.

[0138] Among them, the received signal strength indication, an optional part of the wireless transmission layer, is used to determine the link quality and whether to increase the broadcast transmission strength. Its implementation is performed after the reverse channel baseband receiving filter. In order to obtain the characteristics of the reverse signal, the following processing is done in the specific implementation of RSSI: the baseband IQ power is integrated within 104us to obtain the instantaneous value of RSSI; then the 8192 RSSI instantaneous values ​​are averaged within about 1 second to obtain the average value of RSSI, that is, RSSI (average) = sum (RSSI (instantaneous)) / 8192, and the maximum value of the RSSI instantaneous value within 1 second and the ratio of the RSSI instantaneous value greater than a certain threshold (the number of RSSI instantaneous values ​​greater than a certain threshold / 8192) are given at the same time. Since RSSI is obtained by integrating power in the digital domain and then inferring it to the antenna port, the inconsistency of the reverse channel signal transmission characteristics will affect the accuracy of RSSI.

[0139] The most important means of judging interference is to look at the average value of RSSI under no-load. For a new start-up, there are few users, and the RSSI level under no-load is generally less than -105dBm. When there are services, the RSSI average value will generally not exceed -95dBm when there are multiple services. The reception quality FER can also be used as a reference to judge whether there is interference. By finding out whether there is interference caused by cross-area coverage, you can also judge whether there is interference from Ec / Io and the received power of the mobile phone. For external interference, the spectrum analyzer can be used to further find out whether there is an interference source.

[0140] Spectral characteristics may include spectrum width and center frequency.

[0141] Spectrum is the abbreviation of frequency spectrum density, which is the distribution curve of frequency. Complex oscillations are decomposed into harmonic oscillations with different amplitudes and frequencies. The graph of the amplitudes of these harmonic oscillations arranged by frequency is called a spectrum. Spectrum is widely used in optics and radio technology. Spectrum introduces the study of signals from the time domain to the frequency domain, thus bringing a more intuitive understanding. The spectrum decomposed into complex mechanical vibrations is called the mechanical vibration spectrum, the spectrum decomposed into acoustic vibrations is called the acoustic spectrum, the spectrum decomposed into light vibrations is called the spectrum, and the spectrum decomposed into electromagnetic vibrations is called the electromagnetic spectrum. The spectrum is generally included in the range of the electromagnetic spectrum. Analyzing the spectrum of various vibrations can understand many basic properties of the complex vibrations, so spectrum analysis has become a basic method for analyzing various complex vibrations. The spectrum width can be the frequency width between the two upper half maximum intensity points on the distribution curve.

[0142] The center frequency is usually defined as the geometric mean of the bandpass filter (or bandstop filter) frequency. In logarithmic coordinates, it is the midpoint between two 3dB points, and is generally expressed as the arithmetic mean of the two 3dB points. The frequency in the middle of the filter passband is based on the center frequency. The frequency higher than the center frequency until the frequency voltage decays to 0.707 times is the upper side frequency, and the opposite is the lower side frequency. The frequency between the upper and lower side frequencies is the passband.

[0143] Signal timing characteristics may include signal arrival time and signal interval. The signal arrival time may be the time it takes for a signal to arrive at a destination. The signal interval may be the time interval between consecutive signals.

[0144] Modulation characteristics may include modulation scheme and symbol rate.

[0145] In order to ensure the communication effect and overcome the problems in long-distance signal transmission, it is necessary to move the signal spectrum to a high-frequency channel for transmission through modulation. This process of loading the signal to be sent into a high-frequency signal is called modulation. In practical applications, whether it is an analog signal or a digital signal, there are usually three most basic modulation methods: amplitude modulation (ASK), frequency modulation (FSK) and phase modulation (PSK). Various other modulation methods are improvements or combinations of the above methods. For example, quadrature amplitude modulation QAM is a combination of amplitude modulation and phase modulation; minimum shift keying MSK is an improvement of FSK; Gaussian filtered minimum shift keying GMSK is an improvement of MSK, which inserts a Gaussian low-pass pre-modulation filter before the MSK modulator, thereby improving spectrum utilization and communication quality; orthogonal frequency division multiplexing modulation OFDM can be regarded as a modulation method for multiple carriers.

[0146] The data after channel coding and interleaving is called symbol, and the flow of symbols per unit time is called symbol rate. After channel coding, a lot of redundant information is added, and one bit corresponds to one symbol (determined by the coding efficiency), so the symbol rate is equal to the bit rate multiplied by the number of symbols corresponding to each bit, which is also equal to the bit rate divided by the coding efficiency.

[0147] It should be noted that, in addition to the above-mentioned indicators, the physical layer characteristics may also include other indicators. In practical applications, the specific indicators of the physical layer characteristics may be set according to actual needs, and the embodiments of the present invention do not limit this.

[0148] Furthermore, since some network devices, such as routers or access points (APs), have the ability to monitor and record physical layer characteristics, these network devices can provide relevant data through SNMP (Simple Network Management Protocol), Syslog or a proprietary management interface. Therefore, in addition to being collected by the monitoring device itself, the current physical layer characteristics can also be obtained from the network device by the monitoring device. In addition, sometimes software tools can be used to collect physical layer characteristic data. These tools can be run on ordinary computers or mobile devices, so the monitoring device can also obtain them from the computer or mobile device. Of course, the current physical layer characteristics can also be obtained by other means. In actual applications, the specific collection method of the current physical layer characteristics can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0149] Step 402: Detect the current physical layer characteristics to determine whether there are abnormal characteristics.

[0150] After obtaining the current physical layer characteristics, the monitoring device can detect whether there are abnormal characteristics in the current physical layer characteristics. If there are abnormal characteristics, it means that there are terminal devices with abnormal connections among the terminal devices connected to the wireless network; if there are no abnormal characteristics, it means that the terminal devices connected to the wireless network are all connected normally.

[0151] In the embodiment of the present invention, the detecting the current physical layer feature to determine whether there is an abnormal feature includes:

[0152] The current physical layer features are detected by using a preset normal feature model to determine whether there are abnormal features in the current physical layer features.

[0153] Specifically, the generated normal feature model can be used to detect the current physical layer feature, so as to determine whether there are abnormal features in the current physical layer feature. Among them, the normal feature model is used to describe the distribution and behavior of the physical layer feature under normal operating conditions. The normal feature model can include the normal range of various indicators. If the value of an indicator in the current physical layer feature exceeds the normal range, then it means that the indicator is abnormal. For example, assuming that the normal range of RSSI is [-70dBm, -30dBm], and the value of RSSI in the current physical layer feature is -80dBm, then the RSSI in the current physical layer feature is an abnormal feature.

[0154] Further, after obtaining the current physical layer characteristics, the current physical layer characteristics can be preprocessed to obtain the preprocessed physical layer characteristics, and then the preprocessed physical layer characteristics are detected. Preprocessing includes but is not limited to data deduplication, data conversion, and data extraction. In actual applications, whether the current physical layer characteristics need to be preprocessed, and the specific method of preprocessing can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0155] In the embodiment of the present invention, the normal feature model is generated in the following manner:

[0156] Acquire historical physical layer characteristics of the wireless network in a normal state;

[0157] The historical physical layer characteristics are modeled using a preset statistical method and rule definition to obtain a normal characteristic model.

[0158] Specifically, when the wireless network is in a normal state (that is, all connected terminal devices in the wireless network are connected normally), the physical layer characteristics (referred to as "historical physical layer characteristics") are obtained, and then the historical physical layer characteristics are modeled using preset statistical methods and rule definitions to obtain a normal characteristic model.

[0159] Among them, the statistical method can adopt methods such as mean, variance, standard deviation, etc., and the rule definition can define the normal range of the feature and the abnormal judgment rule. In practical applications, the specific statistical method and rule definition can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0160] Further, after obtaining the historical physical layer features, the historical physical layer features can be preprocessed to obtain the preprocessed historical physical layer features, and then the processed historical physical layer features can be modeled. The preprocessing may include removing outliers or other processing. In practical applications, whether preprocessing is required and the specific processing method of preprocessing can be set according to actual needs, and the embodiments of the present invention do not limit this.

[0161] Step 403: If there are abnormal features, an abnormal alarm is triggered, and abnormal clearing processing is performed on the terminal device corresponding to the abnormal features.

[0162] If an abnormal feature is detected, an abnormal alarm can be triggered to notify the user, and the terminal device corresponding to the abnormal feature can be cleared, thereby improving the security of the wireless network.

[0163] In the embodiment of the present invention, the abnormality clearing process for the terminal device corresponding to the abnormal feature includes:

[0164] Signals of the terminal device corresponding to the abnormal feature are blocked so that the terminal device is disconnected from the wireless network.

[0165] Specifically, since the monitoring device is deployed between the network device and the terminal device, after detecting an abnormal feature, the monitoring device can block the signal of the terminal device corresponding to the abnormal feature, thereby disconnecting the terminal device from the wireless network.

[0166] Step 404: Visually display the current physical layer characteristics, the abnormal characteristics, and the abnormal alarm.

[0167] Specifically, the monitoring device can be connected to the display device. After obtaining the current physical layer characteristics, abnormal characteristics and triggering abnormal alarms, the current physical layer characteristics, abnormal characteristics and abnormal alarms can be output to the display device for visual display. In this way, the user can view various indicators of the wireless network in the display device, and the user can also set parameters and rules in the visual interface.

[0168] Among them, the monitoring device and the display device can be connected by wire, by wireless, or by other means. In actual applications, the connection method between the monitoring device and the display device can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0169] In the embodiment of the present invention, after obtaining the current physical layer characteristics of the wireless network at the current moment, the monitoring device detects the current physical layer characteristics to determine whether there are abnormal characteristics; if there are abnormal characteristics, an abnormal alarm is triggered, and the terminal device corresponding to the abnormal characteristics is cleared. Since the physical layer characteristics are difficult to forge, detecting network intrusions through the physical layer characteristics of the wireless network can effectively improve the security of the wireless network and prevent various types of network intrusions.

[0170] Furthermore, the monitoring device can output the current physical layer characteristics, abnormal characteristics and abnormal alarms to the display device for visual display, so that the user can view various indicators of the wireless network in the display device, and the user can also set parameters and rules in the visual interface, which improves the convenience of user use.

[0171] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0172] Reference Figure 5 , shows a structural block diagram of an embodiment of a wireless network management device of the present invention, which may specifically include the following modules:

[0173] The acquisition module 501 is used to acquire the current physical layer characteristics of the wireless network at the current moment;

[0174] A detection module 502 is used to detect the current physical layer feature to determine whether there is an abnormal feature;

[0175] The alarm module 503 is used to trigger an abnormal alarm if there are abnormal features, and perform abnormal clearing processing on the terminal device corresponding to the abnormal features.

[0176] In the embodiment of the present invention, the acquisition module is specifically used to:

[0177] Obtain a received signal strength indication, spectrum characteristics, signal timing characteristics, and modulation characteristics of the wireless network at the current moment.

[0178] In the embodiment of the present invention, the detection module is specifically used to:

[0179] The current physical layer features are detected by using a preset normal feature model to determine whether there are abnormal features in the current physical layer features.

[0180] In the embodiment of the present invention, a first generating module is further included, which is specifically used to:

[0181] Acquire historical physical layer characteristics of the wireless network in a normal state;

[0182] The historical physical layer characteristics are modeled using a preset statistical method and rule definition to obtain a normal characteristic model.

[0183] In the embodiment of the present invention, the alarm module is specifically used for:

[0184] Signals of the terminal device corresponding to the abnormal feature are blocked so that the terminal device is disconnected from the wireless network.

[0185] In an embodiment of the present invention, it also includes:

[0186] A second generating module is used to generate a processing record of the abnormality clearing process;

[0187] An evaluation module, used to evaluate the detection capability based on the processing record and obtain an evaluation result when a preset evaluation condition is met;

[0188] An updating module is used to update the preset normal feature model based on the evaluation result to obtain an updated normal feature model.

[0189] In an embodiment of the present invention, it also includes:

[0190] The display module is used to visually display the current physical layer characteristics, the abnormal characteristics and the abnormal alarm.

[0191] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0192] An embodiment of the present invention further provides an electronic device, including:

[0193] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned wireless network management method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0194] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned wireless network management method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0195] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0196] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0197] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0198] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0199] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0200] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0201] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0202] The above is a detailed introduction to a wireless network management method and a wireless network management device provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A wireless network management method, characterized in that: The method comprises: Obtaining current physical layer characteristics of the wireless network at the current moment; Detecting the current physical layer feature to determine whether there is an abnormal feature; If there are abnormal features, an abnormal alarm is triggered, and abnormal clearing processing is performed on the terminal device corresponding to the abnormal features.

2. The wireless network management method according to claim 1, characterized in that: The obtaining of the current physical layer characteristics of the wireless network at the current moment includes: Obtain a received signal strength indication, spectrum characteristics, signal timing characteristics, and modulation characteristics of the wireless network at the current moment.

3. The wireless network management method according to claim 1, characterized in that: The detecting the current physical layer feature to determine whether there is an abnormal feature includes: The current physical layer features are detected by using a preset normal feature model to determine whether there are abnormal features in the current physical layer features.

4. The wireless network management method according to claim 3, characterized in that: The normal feature model is generated in the following way: Acquire historical physical layer characteristics of the wireless network in a normal state; The historical physical layer characteristics are modeled using a preset statistical method and rule definition to obtain a normal characteristic model.

5. The wireless network management method according to claim 1, characterized in that: The performing abnormality clearing processing on the terminal device corresponding to the abnormal feature includes: Signals of the terminal device corresponding to the abnormal feature are blocked so that the terminal device is disconnected from the wireless network.

6. The wireless network management method according to claim 1, characterized in that: Also includes: Generating a processing record of the abnormality clearing process; When the preset evaluation conditions are met, the detection capability is evaluated based on the processing record to obtain an evaluation result; The preset normal feature model is updated based on the evaluation result to obtain an updated normal feature model.

7. The wireless network management method according to claim 1, characterized in that: Also includes: The current physical layer characteristics, the abnormal characteristics and the abnormal alarm are visually displayed.

8. A wireless network management device, characterized in that: The device comprises: An acquisition module, used to acquire current physical layer characteristics of the wireless network at the current moment; A detection module, used to detect the current physical layer characteristics to determine whether there are abnormal characteristics; The alarm module is used to trigger an abnormal alarm if there are abnormal features, and perform abnormal clearing processing on the terminal device corresponding to the abnormal features.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the wireless network management method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the wireless network management method according to any one of claims 1 to 7 are implemented.

Images