Wireless camera identification method

Abstract

The invention discloses a wireless camera identification method, which comprises the following steps of: accessing scanning equipment into a target local area network, and scanning survival electronic equipment in the target local area network by utilizing the scanning equipment; acquiring various device feature information of each electronic device from the message sent by each electronic device; classifying the electronic devices according to the feature information of the devices to obtain normal devices and suspected devices; dividing the preset time period into a plurality of detection time periods, and setting a risk weight for each detection time period; counting the online time ratio of each suspected device in each detection time period; obtaining the suspicion degree of each suspicion device according to the risk weight of each detection time period and the online time ratio of each suspicion device in each detection time period; and if the suspicion degree corresponding to the suspicion equipment is greater than a suspicion preset value, preliminarily determining that the suspicion equipment is a hidden wireless camera. According to the application, the scanning equipment can be accessed to the wireless network, and the electronic equipment in the wireless network can be systematically scanned and analyzed.

Description

Technical Field

[0001] The present application relates to the field of wireless camera detection, and in particular to a wireless camera identification method. Background Art

[0002] Voyeurs often install Wi-Fi-connected wireless cameras at the location they're spying on. Therefore, existing methods for identifying hidden wireless cameras often require analyzing Wi-Fi packets to confirm the presence of a hidden camera, without requiring access to Wi-Fi passwords. However, existing technologies lack a method for systematically scanning and analyzing devices within a wireless network. Summary of the Invention

[0003] The purpose of this application is to provide a wireless camera identification method that can access a wireless network and systematically scan and analyze each electronic device in the wireless network.

[0004] To achieve the above objectives, the present application provides a wireless camera identification method, comprising: Connecting a scanning device to a target local area network, and using the scanning device to scan for surviving electronic devices in the target local area network; Performing information detection on each of the electronic devices, and obtaining a plurality of device feature information of each of the electronic devices from the messages sent by each of the electronic devices; Classifying each of the electronic devices according to the feature information of each device to obtain normal devices and suspicious devices; Divide the preset time period into several detection time periods and set a risk weight for each detection time period, wherein the preset time period is the time period in which the online status of each suspected device needs to be counted; Counting the online time percentage of each suspected device in each detection time period; Obtaining the suspicion level of each suspected device according to the risk weight of each detection time period and the online time ratio of each suspected device in each detection time period; If the suspicion level corresponding to the suspicious device is greater than a preset suspicion value, it is preliminarily determined that the suspicious device is a hidden wireless camera.

[0005] Optionally, the calculation formula for the suspicion degree includes:

[0006] in, is the suspicion degree, The detection time period The risk weight of The suspected device in the detection time period The online time percentage in .

[0007] Optionally, the classifying the electronic devices according to the device feature information to obtain normal devices and suspicious devices includes: Filtering the normal device from the electronic devices using the device feature information; The electronic device that still cannot be classified as the normal device after screening using the device feature information is classified as the suspected device.

[0008] Optionally, the device feature information includes port information, operating system information, MAC address information, and host name information; The step of screening out the normal device from the electronic devices by using the device feature information includes: confirming whether the port information corresponding to each electronic device is normal, if so, the electronic device is the normal device, if not, the electronic device is the first undetermined device; confirming whether the operating system information corresponding to each first undetermined device is normal, if so, the first undetermined device is the normal device, if not, the first undetermined device is the second undetermined device; confirming whether the MAC address information corresponding to each second undetermined device is normal; if so, the second undetermined device is the normal device; if not, the second undetermined device is the third undetermined device; Confirm whether the host name information corresponding to each of the third undetermined devices is normal. If so, the third undetermined device is the normal device; if not, the third undetermined device is the suspected device.

[0009] Optionally, confirming whether the port information corresponding to each electronic device is normal includes: Obtaining a port mapping table, wherein the port mapping table includes a correspondence between the port information and the device type; It is determined whether the port information in the port mapping table includes the port information of the electronic device. If so, the electronic device is the normal device; if not, the electronic device is the first undetermined device.

[0010] Optionally, confirming whether the operating system information corresponding to each of the first undetermined devices is normal includes: Obtaining an operating system feature table, where the operating system feature table is used to store operating system types; Confirm whether the operating system information of the first undetermined device is consistent with the operating system type in the operating system feature table. If so, the first undetermined device is the normal device; if not, the first undetermined device is the second undetermined device.

[0011] Optionally, confirming whether the MAC address information corresponding to each second undetermined device is normal includes: Obtaining a MAC address mapping table, the MAC address mapping table including a correspondence between a characteristic field of the MAC address of each electronic device and a device manufacturer and / or device type; Determine whether the characteristic field of the MAC address of the second undetermined device exists in the MAC address mapping table. If so, the second undetermined device is the normal device; if not, the second undetermined device is the third undetermined device.

[0012] Optionally, confirming whether the host name information corresponding to each of the third undetermined devices is normal includes: extracting device information of the third undetermined device from the host name information; Obtaining a device manufacturer feature table, wherein the device manufacturer feature table is used to store device manufacturer information; Confirm that the device information corresponds to the device manufacturer information in the device manufacturer feature table. If so, the third undetermined device is the normal device; otherwise, the third undetermined device is the suspected device.

[0013] Optionally, the performing information detection on the electronic device to obtain device feature information of the electronic device includes: sending an information detection message to the electronic device, and acquiring the device characteristic information of the electronic device from the message returned by the electronic device; The information detection message is implemented based on the TCP protocol or the UDP protocol.

[0014] This application connects a scanning device to the target local area network to scan for surviving electronic devices, and screens out suspicious devices based on the device feature information of each electronic device. The suspicion level is obtained based on the risk weight of each detection time period and the proportion of the online time of each suspicious device in each detection time period. The suspicion level is used to screen out electronic devices that may be hidden wireless cameras. If the suspicion level corresponding to the suspected device is greater than the preset suspicion value, it is preliminarily determined that the suspected device is a hidden wireless camera, and a more detailed inspection can be performed on it, thereby connecting the scanning device to the wireless network and systematically scanning and analyzing each electronic device in the wireless network. In addition, this application can cooperate with the existing wireless camera identification method that does not systematically scan the wireless network, and identify wireless cameras from different detection dimensions, making the identification of wireless cameras more accurate. In the process of checking whether the surviving electronic devices are hidden wireless cameras, the present application uses the device feature information for preliminary screening, excludes normal devices, retains suspicious devices, and then obtains the suspicion of each suspected device based on the risk weight of each detection time period and the proportion of online time of each suspected device in each detection time period. Suspicious devices with lower suspicion are excluded, and only suspicious devices with higher suspicion are further inspected. By narrowing the inspection scope and conducting more detailed inspections, computing resources can be saved. At the same time, considering that hidden wireless cameras are usually more active than other electronic devices in some privacy or night time periods, the present application also sets a risk weight for each detection time period, and calculates the suspicion of each suspected device based on the online time of each suspected device in each detection time period, which is conducive to improving the recognition accuracy of hidden wireless cameras. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a flow chart of the wireless camera identification method according to an embodiment of the present application.

[0016] Figures 2 to 7 This is a partial flow chart of the wireless camera identification method according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to explain the technical content, structural features, achieved objectives and effects of this application in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0018] See also Figure 1 , this application discloses a wireless camera identification method, comprising: S1: Connect the scanning device to the target local area network and use it to scan for surviving electronic devices in the target local area network. Surviving electronic devices are those that are currently online and able to communicate. Surviving electronic devices can be found by performing a comprehensive scan of electronic devices within the network using Nmap (an existing network detection and security auditing tool).

[0019] S2: Detect information about each electronic device and obtain various device feature information about each electronic device from the messages sent by each electronic device. Device feature information is feature information in the message that can be used to determine detailed information about the corresponding electronic device (e.g., whether the electronic device is a mobile phone, tablet, or router).

[0020] In some embodiments, step S2 includes: Send information detection messages to electronic devices and obtain the device feature information of the electronic devices from the messages returned by the electronic devices. The information detection messages are implemented based on the TCP protocol or the UDP protocol. For example, if the device feature information includes the MAC address of the electronic device, ARP (Address Resolution Protocol) scanning technology can be used to obtain the IP address of each electronic device and resolve the IP address to a MAC address using the ARP protocol.

[0021] S3: Classify each electronic device according to its characteristic information to obtain normal devices and suspicious devices.

[0022] In some embodiments, device feature information is used to determine whether each electronic device is a smart terminal device (such as a mobile phone, tablet, or computer). If so, it is a normal device; otherwise, it is a suspect device. Suspect devices include electronic devices whose device feature information can be detected but are not smart terminal devices (such as routers, Bluetooth speakers, and printers), as well as electronic devices whose device feature information cannot be detected and whose device category is difficult to distinguish.

[0023] See also Figure 1 and Figure 2 In some embodiments, step S3 includes: S31: Filter out normal devices from electronic devices using feature information of each device.

[0024] S32: Classify the electronic devices that cannot be classified as normal devices after screening using the characteristic information of each device as suspicious devices.

[0025] Specifically, device feature information includes port information, operating system information, MAC address information, and host name information. 1. Port information plays a key role in device classification. Different operating systems and device types, due to their diverse application scenarios, open ports, services, and adopted different transmission protocols. For example, wireless cameras typically open ports for the RTSP protocol (usually port 554), while iPhone operating systems typically open port 62708.

[0026] 2. Operating system information can be obtained from electronic device packets. This information clearly distinguishes between Windows-based PCs and Android-based mobile devices. Operating system fingerprinting can be used to infer the type and version of the target device's operating system by sending specific data packets to the target device using tools such as Nmap and analyzing the device's response.

[0027] 3. Some fields in the MAC address information can be associated with the device manufacturer, especially for authorized manufacturers such as Xiaomi and Huawei. However, for devices from unknown manufacturers, there may be no association, so the MAC address can be used as a classification basis. To obtain the MAC address, you can send an ARP (Address Resolution Protocol) request packet to the target device and resolve the IP address in the target device's response content according to the ARP protocol to obtain the MAC address.

[0028] 4. Host name information usually includes device information, which includes specific information such as the device manufacturer. Therefore, if the host name of an electronic device is obtained, and it contains detailed device information, this device information can be used to confirm whether the electronic device is a normal device.

[0029] See also Figure 2 and Figure 3 , step S31 includes: S311: Check whether the port information corresponding to each electronic device is normal. If so, the electronic device is a normal device; if not, the electronic device is a first undetermined device. It is understood that if the corresponding port information of an electronic device cannot be extracted from its message, then the normality of the electronic device cannot be determined based on the port information, and the electronic device should be a first undetermined device.

[0030] See also Figure 3 and Figure 4 More specifically, step S311 includes: S3111, obtaining a port mapping table, which includes a correspondence between port information and device types. The port mapping table can be obtained by collecting and summarizing the correspondence between the device types of electronic devices produced by various regular manufacturers and the port information opened by the electronic devices.

[0031] S3112, determining whether the port information in the port mapping table includes the port information of the electronic device; if so, the electronic device is a normal device; if not, the electronic device is a first undetermined device.

[0032] Optionally, the correspondence between the port information and the device type in the port mapping table may be continuously updated to adapt to different detection scenarios.

[0033] S312: Check whether the operating system information corresponding to each first undetermined device is normal. If so, the first undetermined device is considered a normal device; if not, the first undetermined device is considered a second undetermined device. It is understood that if the corresponding operating system information of a first undetermined device cannot be extracted from its message, then the normality of the first undetermined device cannot be determined based on the operating system information, and the first undetermined device should be considered a second undetermined device.

[0034] See also Figure 3 and Figure 5 More specifically, step S312 includes: S3121, obtaining an operating system feature table, where the operating system feature table is used to store operating system types. The operating system feature table can be obtained by collecting and summarizing operating system information of electronic devices produced by various regular manufacturers in advance.

[0035] S3122, confirm whether the operating system information of the first undetermined device is consistent with the operating system type in the operating system feature table. If so, the first undetermined device is a normal device; if not, the first undetermined device is a second undetermined device.

[0036] Optionally, the operating system types in the operating system feature table may be continuously updated to adapt to different detection scenarios.

[0037] S313: Check whether the MAC address information of each second undetermined device is normal. If so, the device is considered normal; if not, the device is considered a third undetermined device. It is understood that if the corresponding MAC address information of a second undetermined device cannot be extracted from its message, then the normality of the second undetermined device cannot be determined based on the MAC address information, and the second undetermined device should be considered a third undetermined device.

[0038] See also Figure 3 and Figure 6 More specifically, based on the MAC address information of each second undetermined device, filtering out normal devices from each second undetermined device includes: S3131: Obtain a MAC address mapping table. The MAC address mapping table includes a correspondence between characteristic fields of the MAC address of each electronic device and the device manufacturer and / or device type. The MAC address mapping table can be obtained by pre-collecting the correspondence between the device type of electronic devices produced by various legitimate manufacturers and the characteristic fields of the MAC addresses of the electronic devices. It is understood that the characteristic fields of electronic devices from different manufacturers may vary.

[0039] S3132, determine whether the characteristic field of the MAC address of the second undetermined device exists in the MAC address mapping table. If so, the second undetermined device is a normal device; if not, the second undetermined device is a third undetermined device.

[0040] Optionally, the correspondence between each characteristic field in the MAC address mapping table and the device manufacturer and / or device type may be continuously updated to adapt to different detection scenarios.

[0041] S314: Verify whether the host name information corresponding to each third undetermined device is normal. If so, the device is considered normal; if not, the device is considered a suspect. It is understood that if the corresponding host name information of a third undetermined device cannot be extracted from its message, then the host name information cannot be used to determine whether the third undetermined device is normal, and the third undetermined device is considered a suspect.

[0042] See also Figure 3 and Figure 7 More specifically, based on the host name information of each third undetermined device, the normal devices are screened out from the third undetermined devices, including: S3141: Extract device information of the third undetermined device from the host name information.

[0043] S3142: Obtain a device manufacturer feature table, which is used to store device manufacturer information. The device manufacturer feature table can be obtained by collecting and aggregating information from various regular manufacturers in advance.

[0044] S3143, confirming whether the device information corresponds to the device manufacturer information in the device manufacturer feature table. If so, the third undetermined device is a normal device; otherwise, the third undetermined device is a suspect device.

[0045] For example, if the host name information of an electronic device is "HUAWEI_Pad_5G", the device information of the electronic device can be determined to be "HUAWEI" through its host name information. There is a corresponding relationship between "HUAWEI" and "Huawei Company" in the device manufacturer feature table, so it can be determined that the electronic device is an electronic device produced by "Huawei Company".

[0046] Optionally, the information of each device manufacturer in the device manufacturer feature table may be continuously updated to adapt to different detection scenarios.

[0047] Of course, in the process of gradually using port information, operating system information, MAC address information and host name information to filter out normal devices, the order of filtering the port information, operating system information, MAC address information and host name information for each electronic device is not prioritized. It is only necessary to filter out the normal devices each time and then hand over the remaining electronic devices to the next category of device feature information for screening.

[0048] S4: Divide the preset time period into several detection time periods and assign a risk weight to each detection time period. The preset time period is the time period during which the online status of each suspected device needs to be counted. The risk of hidden wireless cameras capturing the user's privacy varies across different time periods within the preset time period. Furthermore, hidden wireless cameras are typically more active than other electronic devices during private or nighttime hours. Therefore, it is necessary to divide the preset time period into several detection time periods and assign a risk weight to each detection time period.

[0049] For example, the preset time period is set to 0:00 to 24:00 in a day, and the preset time period is divided into multiple detection time periods. Risk weights are assigned to each detection time period, and the following table 1 is obtained: Table 1:

[0050] Of course, when actually calculating the suspicion level, we also consider time distribution characteristics such as holidays / weekends (when the frequency of illegal activities increases), all-day online stability (legitimate devices are stably online all day), and the number of active days within the time window, and set risk weights for different detection time periods.

[0051] It can be understood that there is no order between step S4 and any of steps S1-S3. For example, step S4 may be performed first, and then steps S1-S3.

[0052] S5: Count the online time percentage of each suspected device in each detection time period.

[0053] S6. Obtain the suspicion level of each suspicious device based on the risk weight of each detection time period and the online time percentage of each suspicious device in each detection time period.

[0054] In some embodiments, the calculation formula for suspicion includes:

[0055] in, For suspicion, Detection time period The risk weight of The suspected device is in the detection time period The proportion of online time in .

[0056] For example, the online time percentages of the four devices A, B, C, and D in each detection time period are counted. Based on the risk weights of each detection time period in Table 1, the suspicion levels of devices A, B, C, and D are calculated using the suspicion calculation formula to obtain Table 2.

[0057] Table 2:

[0058] S7: If the suspicion level of the suspected device is greater than the preset suspicion value, the suspected device is preliminarily determined to be a hidden wireless camera. For example, if the preset suspicion value is 0.9, then A, B, and D in Table 2 above are very likely to be hidden wireless cameras and require further investigation.

[0059] Optionally, each suspected device is ranked according to its suspicion level. When further checking for hidden wireless cameras, suspected devices with higher suspicion levels may be checked first according to the ranking, thereby improving the efficiency of the check.

[0060] Alternatively, if the suspected device is a hidden wireless camera, check whether its open ports match the characteristics of a camera device, such as whether common video transmission ports are open. Also, check whether the device's functions and behaviors are consistent with normal devices. If so, and the suspicion is high, the device can be preliminarily determined to be a hidden camera. A positioning algorithm can be used to locate the area where the device is located for further investigation.

[0061] This application connects a scanning device to the target local area network to scan for surviving electronic devices, and screens out suspicious devices based on the device feature information of each electronic device. The suspicion level is obtained based on the risk weight of each detection time period and the proportion of the online time of each suspicious device in each detection time period. The suspicion level is used to screen out electronic devices that may be hidden wireless cameras. If the suspicion level corresponding to the suspected device is greater than the preset suspicion value, it is preliminarily determined that the suspected device is a hidden wireless camera, and a more detailed inspection can be performed on it, thereby connecting the scanning device to the wireless network and systematically scanning and analyzing each electronic device in the wireless network. In addition, this application can cooperate with the existing wireless camera identification method that does not systematically scan the wireless network, and identify wireless cameras from different detection dimensions, making the identification of wireless cameras more accurate. In the process of checking whether the surviving electronic devices are hidden wireless cameras, the present application uses the device feature information for preliminary screening, excludes normal devices, retains suspicious devices, and then obtains the suspicion of each suspected device based on the risk weight of each detection time period and the proportion of online time of each suspected device in each detection time period. Suspicious devices with lower suspicion are excluded, and only suspicious devices with higher suspicion are further inspected. By narrowing the inspection scope and conducting more detailed inspections, computing resources can be saved. At the same time, considering that hidden wireless cameras are usually more active than other electronic devices in some privacy or night time periods, the present application also sets a risk weight for each detection time period, and calculates the suspicion of each suspected device based on the online time of each suspected device in each detection time period, which is conducive to improving the recognition accuracy of hidden wireless cameras.

[0062] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the scope of the patent application of the present application are still within the scope covered by the present application.

Claims

1. A wireless camera identification method, characterized in that: include: Connecting a scanning device to a target local area network, and using the scanning device to scan for surviving electronic devices in the target local area network; Performing information detection on each of the electronic devices, and obtaining a plurality of device feature information of each of the electronic devices from the messages sent by each of the electronic devices; Classifying each of the electronic devices according to the feature information of each device to obtain normal devices and suspicious devices; Divide the preset time period into several detection time periods and set risk weights for each of the detection time periods; Counting the online time percentage of each suspected device within each detection time period; Obtaining the suspicion level of each suspected device according to the risk weight of each detection time period and the online time ratio of each suspected device in each detection time period; If the suspicion level corresponding to the suspicious device is greater than a preset suspicion value, it is preliminarily determined that the suspicious device is a hidden wireless camera.

2. The wireless camera identification method according to claim 1, wherein: The calculation formula of the suspicion degree includes: in, is the suspicion degree, The detection time period The risk weight of The suspected device in the detection time period The online time percentage in .

3. The wireless camera identification method according to claim 1, wherein: The classifying the electronic devices according to the device feature information to obtain normal devices and suspicious devices includes: Filtering the normal device from the electronic devices using the device feature information; The electronic device that still cannot be classified as the normal device after screening using the device feature information is classified as the suspected device.

4. The wireless camera identification method according to claim 3, wherein: The device feature information includes port information, operating system information, MAC address information and host name information; The step of screening out the normal device from the electronic devices by using the device feature information includes: confirming whether the port information corresponding to each electronic device is normal, if so, the electronic device is the normal device, if not, the electronic device is the first undetermined device; confirming whether the operating system information corresponding to each first undetermined device is normal, if so, the first undetermined device is the normal device, if not, the first undetermined device is the second undetermined device; confirming whether the MAC address information corresponding to each second undetermined device is normal; if so, the second undetermined device is the normal device; if not, the second undetermined device is the third undetermined device; Confirm whether the host name information corresponding to each of the third undetermined devices is normal. If so, the third undetermined device is the normal device; if not, the third undetermined device is the suspected device.

5. The wireless camera identification method according to claim 4, wherein: The confirming whether the port information corresponding to each electronic device is normal includes: Obtaining a port mapping table, wherein the port mapping table includes a correspondence between the port information and the device type; It is determined whether the port information in the port mapping table includes the port information of the electronic device. If so, the electronic device is the normal device; if not, the electronic device is the first undetermined device.

6. The wireless camera identification method according to claim 4, wherein: The confirming whether the operating system information corresponding to each of the first undetermined devices is normal includes: Obtaining an operating system feature table, where the operating system feature table is used to store operating system types; Confirm whether the operating system information of the first undetermined device is consistent with the operating system type in the operating system feature table. If so, the first undetermined device is the normal device; if not, the first undetermined device is the second undetermined device.

7. The wireless camera identification method according to claim 4, wherein: The confirming whether the MAC address information corresponding to each second undetermined device is normal includes: Obtaining a MAC address mapping table, the MAC address mapping table including a correspondence between a characteristic field of the MAC address of each electronic device and a device manufacturer and / or device type; Determine whether the characteristic field of the MAC address of the second undetermined device exists in the MAC address mapping table. If so, the second undetermined device is the normal device; if not, the second undetermined device is the third undetermined device.

8. The wireless camera identification method according to claim 4, wherein: The confirming whether the host name information corresponding to each of the third undetermined devices is normal includes: extracting device information of the third undetermined device from the host name information; Obtaining a device manufacturer feature table, wherein the device manufacturer feature table is used to store device manufacturer information; Confirm that the device information corresponds to the device manufacturer information in the device manufacturer feature table. If so, the third undetermined device is the normal device; otherwise, the third undetermined device is the suspected device.

9. The wireless camera identification method according to claim 1, wherein: The performing information detection on each electronic device and obtaining a plurality of device feature information of each electronic device from the message sent by each electronic device includes: sending an information detection message to the electronic device, and acquiring the device characteristic information of the electronic device from the message returned by the electronic device; The information detection message is implemented based on the TCP protocol or the UDP protocol.

Images