Method and device for removing randomization of MAC address in access process of WLAN (Wireless Local Area Network) network terminal
By extracting and weighting the timing features of management frames interacting between STAs and APs in WLAN networks, and utilizing random forest models and MAC address de-randomization models, the problems of low recognition accuracy and efficiency in MAC address de-randomization of WLAN network terminals are solved, achieving more efficient device identification.
Patent Information
- Application Number
- CN202510798503.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-16
- Publication Date
- 2025-09-30
AI Technical Summary
In the prior art, the MAC address de-randomization method for WLAN network terminals has problems with low recognition accuracy and efficiency, especially the difficulty in recognition caused by the consistency characteristics of information elements of the same model of devices.
By capturing the message interaction between network terminals and access points, the management frames of the WLAN association phase and the periodic probe request phase are extracted. After digital processing, the timing features are extracted, and the random forest model is used to determine the feature importance to form a feature vector. The trained MAC address derandomization model is input for recognition.
The accuracy and efficiency of MAC address recognition during WLAN network terminal access are improved. By extracting time series features and performing weighted processing, a more efficient MAC address de-randomization is achieved using a machine learning model.
Smart Images
Figure CN120730294A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to wireless communication equipment access technology, and in particular to a MAC address de-randomization method and device in a WLAN network terminal access process. Background Art
[0002] With the increasing popularity of the internet, wireless technology is developing at an increasingly rapid pace. In traditional network architectures, MAC addresses remain static identifiers. To protect user privacy, random MAC address change (RCM) technology has been widely developed. To address the challenges posed by the growing popularity of RCM technology to traditional applications and services based on fixed MAC addresses, the demand for MAC address derandomization technology is increasing. MAC address derandomization technology extracts features other than the MAC address to identify devices, thereby derandomizing the MAC address.
[0003] Traditional MAC address derandomization research primarily considers the content contained in probe requests sent by network terminals (STAs) to access points (APs). Device identification is achieved by extracting the information element (IE) containing the specified ID and the serial number contained within the IE. However, for devices of the same model, there may be some consistency in the IE, meaning that different devices may have identical features in the IE containing the specified ID, which reduces identification accuracy and efficiency. Summary of the Invention
[0004] In view of the problems existing in the prior art, the object of the present invention is to provide a method and device for de-randomizing MAC addresses in a WLAN network terminal access process with higher accuracy and efficiency.
[0005] In order to achieve the above-mentioned object of the invention, the present invention provides the following technical solutions:
[0006] A method for de-randomizing a MAC address during a WLAN network terminal access process, specifically comprising:
[0007] (1) Capture the messages exchanged between the network terminal and the access point, and extract the management frames in the WLAN association phase and the subsequent periodic probe request phase;
[0008] (2) extracting the timestamp, destination address, and management frame type from the management frame and performing digital processing;
[0009] (3) extracting timing features related to the management frames based on the digitally processed data of the management frames, wherein the timing features include at least the time interval between different types of management frames in the association phase, the type sequence of the management frames in the association phase, the start time of the periodic probe request phase, and the type sequence of the management frames in the periodic probe request phase;
[0010] (4) Determine the importance values of different timing features to the management frame and use the importance values as corresponding weights;
[0011] (5) The vector formed by adding all the time series features and the weighted values of the corresponding weights is used as the feature vector of the network terminal;
[0012] (6) Inputting the feature vector of the network terminal into a trained MAC address de-randomization model to obtain the MAC address of the network terminal, wherein the MAC address de-randomization model is trained by inputting the feature vectors of several known MAC addresses.
[0013] Furthermore, the management frames in step (1) include management frames in probe request, probe response, authentication, association request, association response, and four-step handshake messages.
[0014] Furthermore, the digital processing steps in step (2) specifically include:
[0015] Extract the timestamp of the management frame and record it as Time;
[0016] Determine whether the destination address in the management frame is a broadcast address. If so, set the destination address Dst to 1; otherwise, set it to 0.
[0017] Determine the message type of the management frame and set the corresponding types of the management frames of probe request, probe response, authentication, association request, association response, and four-step handshake to 1, 2, 3, 4, 5, and 6 respectively.
[0018] Furthermore, the timing characteristics also include: stage time boundaries, the destination address of the first management frame in the association stage, the average time of broadcast frames in the association stage, the number of broadcast frames in the association stage, the number of various types of management frames in the association stage, and the start time of various types of management frames in the association stage.
[0019] Furthermore, step (3) specifically includes:
[0020] (3.1) Phase Division: The time corresponding to the last management frame of type Type = 6 is recorded as the phase time boundary first_stage_time_diff. Management frames with a time less than or equal to first_stage_time_diff are divided into the association phase. Management frames with a time greater than first_stage_time_diff are divided into the periodic probe request phase. The time of the first management frame with a time greater than first_stage_time_diff is recorded as the start time of the periodic probe request phase next_packet_after_first_stage.
[0021] (3.2) Broadcast frame feature extraction: Determine whether the destination address Dst of the first management frame in the association phase is 1. If it is 1, record the destination address Dst_One_Exist of the first management frame in the association phase as 1. Calculate the number of management frames with a destination address Dst of 1 in the association phase, and record it as the number of broadcast frames in the association phase Dst_One_Count. Calculate the average Time of all management frames with a destination address of 1, and record it as the average broadcast frame time Avg_Time_Dst_One in the association phase.
[0022] (3.3) Management frame type sequence feature extraction: Extract the Type sequences of management frames in the association phase and the periodic probe request phase in chronological order, respectively, and record them as the association phase management frame type sequence Type_Sequence and the periodic probe request phase management frame type sequence Type_Sequence_In_Range. Calculate the number of management frames with Type t in Type_Sequence, and record it as the number of type t management frames in the association phase Type_t_Count, where t is an integer between 1 and 6. Calculate the types of numbers that appear in Type_Sequence, and record it as the number of types in the association phase Type_Unique_Count. Calculate the number of descending numbers in Type_Sequence, and record it as the number of descending numbers in the association phase Type_Sequence_Descending_Count.
[0023] (3.4) Time data feature extraction: Record the time corresponding to the first appearance of the management frame corresponding to each Type, and record it as the start time Type_t_first_Occurrence_Time of the type t management frame in the association phase. t is an integer between 1 and 6. Calculate the difference between Type_t_first_Occurrence_Time and Type_t-1_first_Occurrence_Time when t is an integer between 2 and 6, and use it as the time interval Type_t_first_Occurrence_Time_Diff of the type t management frame in the association phase.
[0024] Furthermore, in step (4), when determining the importance values of different timing features to the management frame, a random forest model is used.
[0025] Furthermore, the MAC address de-randomization model is specifically a machine learning model.
[0026] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above method.
[0027] A computer-readable storage medium having a computer program / instruction stored thereon, which implements the above method when executed by a processor.
[0028] A computer program product comprises a computer program / instruction, wherein the computer program / instruction implements the above method when executed by a processor.
[0029] Compared with the prior art, the present invention has the following advantages: the present invention proposes a MAC address derandomization technology for a device access process in a WLAN network, which extracts timing features during the STA-AP association process and the STA's periodic transmission of probe requests after association, obtains the importance of different features and weights them, and obtains a set of features that can be used for device identification. The features are used to derandomize the MAC address, thereby improving the accuracy of identification. The derandomization uses a trained model, thereby improving the efficiency of identification. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] Figure 1 This is a flow chart of a method for de-randomizing a MAC address during a WLAN network terminal access process provided by an embodiment of the present invention;
[0031] Figure 2 This is a schematic diagram of some management frames extracted in an embodiment of the present invention;
[0032] Figure 3is a schematic diagram of a temporal feature extraction process according to an embodiment of the present invention;
[0033] Figure 4 Schematic diagram of the stage division process of an embodiment of the present invention;
[0034] Figure 5 Schematic diagram of broadcast frame feature extraction according to an embodiment of the present invention;
[0035] Figure 6 is a schematic diagram of extracting features of a management frame type sequence according to an embodiment of the present invention;
[0036] Figure 7 Schematic diagram of time data feature extraction according to an embodiment of the present invention;
[0037] Figure 8 It is a structural diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0038] The technical solutions in the embodiments of the present invention will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present invention.
[0039] Example 1
[0040] An embodiment of the present invention provides a method for de-randomizing a MAC address during a WLAN network terminal access process, specifically comprising:
[0041] (1) Capture the messages exchanged between the network terminal (STA) and the access point (AP), and extract the management frames in the WLAN association phase and the subsequent periodic probe request phase.
[0042] The management frames include the management frames in the probe request, probe response, authentication, association request, association response, and four-step handshake messages. Figure 2 shown.
[0043] (2) Extract the timestamp, destination address and management frame type from the management frame and perform digital processing.
[0044] The steps of the digital processing specifically include: extracting the timestamp of the management frame and recording it as Time; determining whether the destination address in the management frame is a broadcast address, and if so, setting the destination address Dst to 1, otherwise setting it to 0; determining the message type to which the management frame belongs, and setting the corresponding types Type to 1, 2, 3, 4, 5, and 6 for management frames of the message types of probe request, probe response, authentication, association request, association response, and four-step handshake, respectively.
[0045] (3) Extracting the timing features related to the management frame based on the digitally processed data of the management frame.
[0046] The timing characteristics include at least the time interval between management frames of different types in the association phase, the management frame type sequence in the association phase, the start time of the periodic detection request phase, and the management frame type sequence in the periodic detection request phase.
[0047] In other embodiments, the timing characteristics may also include stage time boundaries, the destination address of the first management frame in the association stage, the average time of broadcast frames in the association stage, the number of broadcast frames in the association stage, the number of various types of management frames in the association stage, the start time of various types of management frames in the association stage, etc.
[0048] like Figure 3 As shown in Figure 2, the specific steps for extracting temporal features are:
[0049] (3.1) Stage division: Figure 4 As shown, the Time corresponding to the last management frame of type Type=6 is recorded as the stage time boundary first_stage_time_diff, the management frames with Time less than or equal to first_stage_time_diff are divided into the association stage (stage A), and the management frames with Time greater than first_stage_time_diff are divided into the periodic sending of probe requests stage (stage B), and the Time of the first management frame with Time>first_stage_time_diff is recorded as the start time of the periodic sending of probe requests stage next_packet_after_first_stage. If there is no management frame, this feature is recorded as 0;
[0050] (3.2) Broadcast frame feature extraction: Figure 5 As shown, determine whether the destination address Dst of the first management frame in the association phase is 1. If it is 1, record the destination address Dst_One_Exist of the first management frame in the association phase as 1, calculate the number of management frames with the destination address Dst of 1 in the association phase, and record it as the number of broadcast frames in the association phase Dst_One_Count, calculate the average value of the Time of all management frames with the destination address of 1, and record it as the average broadcast frame time Avg_Time_Dst_One in the association phase;
[0051] (3.3) Management frame type sequence feature extraction: Figure 6As shown, the Type sequences of the management frames in the association phase and the periodic probe request phase are extracted in chronological order, respectively, and recorded as the association phase management frame type sequence Type_Sequence and the periodic probe request phase management frame type sequence Type_Sequence_In_Range, respectively. The number of management frames with Type t in Type_Sequence is calculated, recorded as the number of type t management frames in the association phase Type_t_Count, where t is any integer between 1 and 6 (including 1 and 6). The type of the number appearing in Type_Sequence is calculated, recorded as the number of types in the association phase Type_Unique_Count, and the number of descending numbers in Type_Sequence is calculated, recorded as the descending number in the association phase Type_Sequence_Descending_Count;
[0052] (3.4) Time data feature extraction: Figure 7 As shown, the time corresponding to the first occurrence of the management frame corresponding to each Type is recorded, and it is recorded as the start time Type_t_first_Occurrence_Time of the type t management frame in the association phase. If the corresponding feature cannot be extracted, it is recorded as 0. t is an integer between 1 and 6. When t is an integer between 2 and 6 (including 2 and 6), the difference between Type_t_first_Occurrence_Time and Type_t-1_first_Occurrence_Time is calculated as the time interval Type_t_first_Occurrence_Time_Diff of the type t management frame in the association phase.
[0053] The timing characteristics are shown in Table 1 below:
[0054] Table 1 Timing characteristics
[0055]
[0056]
[0057] (4) Determine the importance values of different timing features to the management frame and use the importance values as corresponding weights.
[0058] The time series features and device labels are input into the random forest model for classification, and the model is used to calculate the importance ranking of different features and normalize them to obtain the importance value. The details are shown in Table 2 below:
[0059] Table 2 Feature importance values
[0060]
[0061]
[0062] (5) The vector formed by the weighted values of all time series features and corresponding weights is used as the feature vector of the network terminal.
[0063] The weighted value is the product of the time series feature and the corresponding weight. Then, the weighted values of all time series features are formed into a vector as the feature vector of the network terminal.
[0064] (6) Input the feature vector of the network terminal into the trained MAC address de-randomization model to obtain the MAC address of the network terminal.
[0065] The MAC address de-randomization model is trained by inputting feature vectors of several known MAC addresses, and can be a machine learning model, a neural network model, or the like.
[0066] Example 2
[0067] Figure 8 This is a schematic diagram of the structure of a computer device provided by an embodiment of the present invention, which provides services for implementing the method of the first embodiment of the present invention. Figure 8 As shown, the device may include: a memory 301 storing a computer executable program; a processor 302 coupled to the memory 301; the processor 302 calls the computer executable program stored in the memory 301 to execute the steps in the method described in embodiment 1.
[0068] The memory 301 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory. The device may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the memory 301 may be used to read and write non-removable, non-volatile magnetic media (commonly referred to as "hard drives"). A program / utility having a set (at least one) of program modules may be stored in, for example, the memory 301, such program modules including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The computer executable program of the program module typically performs the functions and / or methods in the embodiments described herein.
[0069] The processor 302 executes various functional applications and data processing by running the programs stored in the memory 301, such as implementing the method provided in the first embodiment of the present invention.
[0070] The code of the computer executable program can be written in one or more programming languages or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages.
[0071] Example 3
[0072] An embodiment of the present invention provides a storage medium containing a computer executable program. When the computer executable program is executed by a computer processor, it is used to perform the method of the first embodiment.
[0073] The storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or components, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing a program that can be used by an instruction execution system, device or device or used in combination with it.
[0074] Of course, the computer executable program of the storage medium provided by the embodiment of the present invention is not limited to the above method operations, but can also execute related operations in the method provided by any embodiment of the present invention.
[0075] Example 4
[0076] The embodiment of the present invention also provides a computer product, such as an app on a mobile phone, a tablet, an installation program on a computer, etc., which includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the method described in Example 1 is implemented. The code of the computer executable program for performing the operation of the present invention can be written in one or more programming languages or a combination thereof, and the programming language includes an object-oriented programming language, such as Java, Smalltalk, C++, and also includes a conventional procedural programming language, such as "C" language or similar programming language. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (for example, using an Internet service provider to connect via the Internet).
[0077] It should be noted that, in this document, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.
[0078] It should be understood that the above embodiments and descriptions only describe the principles, main features and advantages of the present invention. Without departing from the spirit and scope of the present invention, the present invention may be subject to various changes and improvements, and these changes and improvements all fall within the scope of protection of the present invention.
Claims
1. A method for de-randomizing a MAC address during a WLAN network terminal access process, characterized in that: The method specifically includes: (1) Capture the messages exchanged between the network terminal and the access point, and extract the management frames in the WLAN association phase and the subsequent periodic probe request phase; (2) extracting the timestamp, destination address, and management frame type from the management frame and performing digital processing; (3) extracting timing features related to the management frames based on the digitally processed data of the management frames, wherein the timing features include at least the time interval between different types of management frames in the association phase, the type sequence of the management frames in the association phase, the start time of the periodic probe request phase, and the type sequence of the management frames in the periodic probe request phase; (4) Determine the importance values of different timing features to the management frame and use the importance values as corresponding weights; (5) The vector formed by adding all the time series features and the weighted values of the corresponding weights is used as the feature vector of the network terminal; (6) Inputting the feature vector of the network terminal into a trained MAC address de-randomization model to obtain the MAC address of the network terminal, wherein the MAC address de-randomization model is trained by inputting the feature vectors of several known MAC addresses.
2. The MAC address de-randomization method for a WLAN network terminal access process according to claim 1, characterized in that: The management frames described in step (1) include the management frames in the probe request, probe response, authentication, association request, association response, and four-step handshake message.
3. The MAC address de-randomization method for a WLAN network terminal access process according to claim 1, characterized in that: The digital processing steps in step (2) specifically include: Extract the timestamp of the management frame and record it as Time; Determine whether the destination address in the management frame is a broadcast address. If so, set the destination address Dst to 1; otherwise, set it to 0. Determine the message type of the management frame and set the corresponding types of the management frames of probe request, probe response, authentication, association request, association response, and four-step handshake to 1, 2, 3, 4, 5, and 6 respectively.
4. The MAC address de-randomization method for a WLAN network terminal access process according to claim 1, characterized in that: The timing characteristics also include: stage time boundaries, the destination address of the first management frame in the association stage, the average time of broadcast frames in the association stage, the number of broadcast frames in the association stage, the number of various types of management frames in the association stage, and the start time of various types of management frames in the association stage.
5. The MAC address de-randomization method for a WLAN network terminal access process according to claim 4, characterized in that: Step (3) specifically includes: (3.1) Phase Division: The time corresponding to the last management frame of type Type = 6 is recorded as the phase time boundary first_stage_time_diff. Management frames with a time less than or equal to first_stage_time_diff are divided into the association phase. Management frames with a time greater than first_stage_time_diff are divided into the periodic probe request phase. The time of the first management frame with a time greater than first_stage_time_diff is recorded as the start time of the periodic probe request phase next_packet_after_first_stage. (3.2) Broadcast frame feature extraction: Determine whether the destination address Dst of the first management frame in the association phase is 1. If it is 1, record the destination address Dst_One_Exist of the first management frame in the association phase as 1. Calculate the number of management frames with a destination address Dst of 1 in the association phase, and record it as the number of broadcast frames in the association phase Dst_One_Count. Calculate the average Time of all management frames with a destination address of 1, and record it as the average broadcast frame time Avg_Time_Dst_One in the association phase. (3.3) Management frame type sequence feature extraction: Extract the Type sequences of management frames in the association phase and the periodic probe request phase in chronological order, respectively, and record them as the association phase management frame type sequence Type_Sequence and the periodic probe request phase management frame type sequence Type_Sequence_In_Range. Calculate the number of management frames with Type t in Type_Sequence, and record it as the number of type t management frames in the association phase Type_t_Count, where t is an integer between 1 and 6. Calculate the types of numbers that appear in Type_Sequence, and record it as the number of types in the association phase Type_Unique_Count. Calculate the number of descending numbers in Type_Sequence, and record it as the number of descending numbers in the association phase Type_Sequence_Descending_Count. (3.4) Time data feature extraction: Record the time corresponding to the first appearance of the management frame corresponding to each Type, and record it as the start time Type_t_first_Occurrence_Time of the type t management frame in the association phase. t is an integer between 1 and 6. Calculate the difference between Type_t_first_Occurrence_Time and Type_t-1_first_Occurrence_Time when t is an integer between 2 and 6, and use it as the time interval Type_t_first_Occurrence_Time_Diff of the type t management frame in the association phase.
6. The MAC address de-randomization method for a WLAN network terminal access process according to claim 1, characterized in that: When determining the importance values of different timing features to the management frame in step (4), a random forest model is used.
7. The method for de-randomizing a MAC address during a WLAN network terminal access process according to claim 1, wherein: The MAC address de-randomization model is specifically a machine learning model.
8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: The processor executes the computer program to implement the method according to any one of claims 1 to 7.
9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: The computer program / instructions, when executed by a processor, implement the method of any one of claims 1 to 7.
10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.