A method and apparatus for detecting wireless network security

Abstract

The application relates to the technical field of wireless networks, in particular to a method for detecting wireless network security, which comprises the following steps: capturing wireless communication traffic of frequency bands in real time through a hardware module of a radio product, and extracting four-interaction data in a WPA3-SAE handshake process; comparing handshake processes of various frequency bands, verifying hardware generation logic consistency, detecting random number uniqueness and hash matching, counting the number of handshake failures, and determining a potential attack when the number of handshake failures exceeds a dynamic threshold; if it is detected that a 6GHz frequency band uses a WPA2 authentication mode, an alarm is triggered and the frequency band communication is disabled; if any rule is violated, a security anomaly is determined, and a corresponding risk score is output. The system dynamically adjusts a defense strategy according to the score: when the risk is high, the PMK is refreshed or the frequency band is disabled; when the risk is medium, protocol compatibility negotiation is performed; and when the risk is low, only logs are recorded. The application can realize efficient real-time monitoring of wireless network equipment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of wireless networks, and in particular to a method and device for detecting wireless network security. BACKGROUND

[0002] Current wireless network devices widely support multi-band (such as 2.4GHz, 5GHz and 6GHz) communication, but existing security detection schemes mostly rely on statistical indicators or empirical rules for risk assessment, which has obvious shortcomings: on the one hand, it is difficult to directly verify protocol implementation details, resulting in limited recognition ability for protocol layer attacks; on the other hand, in the face of signal interference, device roaming and compatibility problems (such as 6GHz band error enabling WPA2 mode) in multi-band environment, existing schemes mostly use static threshold judgment, which has high false positive rate and cannot dynamically adapt to network changes.

[0003] In addition, some technologies rely on machine learning models for prediction, but model training requires a large amount of labeled data, and the generalization ability for new attacks is insufficient, making it difficult to meet real-time requirements; at the same time, for protocol compatibility problems, existing schemes mostly rely on post-log analysis or manual verification, lacking real-time monitoring and automatic defense mechanisms.

[0004] From the above, how to realize efficient real-time monitoring of wireless network devices still needs to be solved. SUMMARY

[0005] In order to realize efficient real-time monitoring of wireless network devices, the present application provides a method and device for detecting wireless network security.

[0006] In the first aspect, the present application provides a method for detecting wireless network security, which adopts the following technical scheme:

[0007] A method for detecting wireless network security, comprising:

[0008] Real-time capture of wireless communication traffic in 2.4GHz, 5GHz and 6GHz bands through hardware modules of radio products, protocol analysis of wireless communication traffic, and extraction of four interaction data of devices executing WPA3 SAE handshake protocol in each band, wherein the four interaction data include Commit message, Confirm message, PMK generation parameter and hash check value;

[0009] Compared with the SAE handshake process of each frequency band, the consistency of the hardware generation logic is verified, and in the process of verifying the consistency of the hardware generation logic, whether the hardware random number is unique is judged, and whether the Confirm hash value is matched is judged; the number of handshake failures in each frequency band is counted, and if the number of handshake failures in any frequency band exceeds the preset dynamic threshold, it is determined as a potential attack behavior; whether abnormal frames of the WPA2 authentication mode appear in the 6GHz frequency band is detected, and if detected, an alarm is triggered;

[0010] When the number of handshake failures is detected to be abnormal, the hardware module of the wireless radio product automatically sends a deauthentication frame to forcibly disconnect the connection of the target device and trigger a re-handshake process; if abnormal frames of the WPA2 compatible mode are detected in the 6GHz frequency band, the wireless communication function of the 6GHz frequency band is immediately disabled through the hardware interface configuration;

[0011] According to the SAE handshake protocol specification supported by the wireless radio product hardware, a hard rule is defined, including: the Commit message must contain a unique hardware-generated random number and cannot be repeated, the hash value of the Confirm message must be consistent with the hardware parameters in the Commit phase, and the PMK generation must be based on the hardware-level dynamic key exchange algorithm; if any rule is violated, it is determined as a protocol implementation defect or an attack behavior, and the corresponding risk score is output, wherein the risk score corresponds to high risk, medium risk and low risk;

[0012] According to the risk score, the defense strategy is dynamically adjusted: if it is high risk, the PMK is refreshed or the high-risk frequency band is disabled through the hardware key management module; if it is medium risk, the device protocol compatibility is verified through the firmware-level capability negotiation request; if it is low risk, only the abnormal event and defense action log are recorded by the hardware logger.

[0013] By adopting the above technical scheme, the multi-frequency band (2.4GHz / 5GHz / 6GHz) wireless communication traffic is captured in real time by the hardware module of the wireless radio product, the WPA3-SAE handshake protocol data is analyzed, the hardware generation logic (such as random number uniqueness, hash value matching) is verified, and handshake failures and abnormal frames are detected through dynamic threshold. When the risk is high, the connection is automatically disconnected or the key is refreshed, when the risk is medium, the protocol compatibility is negotiated, and when the risk is low, the log is recorded, thereby realizing efficient real-time monitoring and adaptive security protection.

[0014] Optionally, in the cross-frequency band protocol consistency verification module, it further comprises:

[0015] By comparing the hardware protocol version fields of the wireless radio product in different frequency bands, if the protocol versions of at least two frequency bands are detected to be inconsistent, it is marked as a protocol version conflict event;

[0016] Generating a frequency band isolation strategy based on a protocol version conflict event: adding a frequency band with a protocol version conflict to a hardware blacklist to prohibit the device from initiating a new handshake in the frequency band with a protocol version conflict; sending a hardware-level WPA3-SAE capability negotiation request to the target device, and if the device fails to respond, triggering a deauthentication frame and recording a protocol downgrade risk.

[0017] By adopting the above technical solution, the protocol version conflict event is detected and marked by comparing the hardware protocol version fields of the radio product in different frequency bands, and a frequency band isolation strategy is generated. The frequency band with a conflict is added to the hardware blacklist to prevent new handshake requests. At the same time, a hardware-level WPA3-SAE capability negotiation request is sent to verify device compatibility, and if the response fails, a deauthentication frame is triggered and a protocol downgrade risk is recorded, thereby effectively preventing security vulnerabilities and potential attacks caused by inconsistent protocols and improving the security and stability of cross-frequency band communication.

[0018] Optionally, in the frequency band isolation strategy, it further includes:

[0019] The MAC address and frequency band identifier of the conflicting frequency band are written into the hardware blacklist storage unit of the radio product;

[0020] When a new SAE handshake request is initiated by the device in the blacklisted frequency band, the hardware module automatically discards the new SAE handshake request and records the interception log;

[0021] If the device successfully completes the WPA3-SAE handshake in the blacklisted frequency band subsequently, the blacklist identifier of the conflicting frequency band is automatically removed.

[0022] By adopting the above technical solution, the MAC address and frequency band identifier of the conflicting frequency band are written into the hardware blacklist, and the radio product can automatically discard the new handshake request of the blacklisted frequency band and record the log. If the device successfully completes the WPA3-SAE handshake subsequently, the blacklist identifier is automatically removed, effectively preventing unsafe connections and improving system security and resource utilization efficiency.

[0023] Optionally, the method further includes:

[0024] Based on the frequency band isolation action captured by the hardware and the log of the protocol version conflict event, whether the attacker implements a coordinated attack behavior through multiple frequency bands is identified through timestamp association analysis. The coordinated attack behavior includes the attacker inducing the device to downgrade and then switching to the 2.4GHz frequency band through the 6GHz frequency band. Based on the association analysis result, the hardware isolation strategy is dynamically optimized, and the hardware isolation strategy includes strengthening the monitoring of specific frequency bands or expanding the isolation range.

[0025] By adopting the technical scheme, the frequency band isolation action captured by the hardware and the protocol version conflict event are analyzed through the timestamp association, a multi-frequency band cooperative attack behavior (such as switching to 2.4GHz after being induced to degrade by 6GHz frequency band) is recognized, and the hardware isolation strategy is dynamically optimized based on the analysis result, such as strengthening the monitoring of a specific frequency band or expanding the isolation range, so that the cross-frequency band attack is effectively prevented, and the system security is improved.

[0026] Optionally, the method further comprises a defect detection step based on protocol analysis:

[0027] The SAE handshake frame sent by the target device is analyzed at a field level by a hardware analysis module of the radio product, and the hardware random number in the Commit message, the hash value of the Confirm message and the PMK generation parameter are extracted.

[0028] If the hardware random number is missing or repeated in the Commit message, it is determined that there is a protocol implementation defect; if the hash value of the Confirm message is inconsistent with the Commit phase parameter, it is determined that there is a hardware protocol implementation defect.

[0029] According to the hardware protocol implementation defect, a preset risk scoring library is matched, and a corresponding risk level is output.

[0030] By adopting the technical scheme, the SAE handshake frame is analyzed at a field level by the hardware analysis module of the radio product, whether the hardware random number in the Commit message is missing or repeated, and whether the hash value of the Confirm message is consistent with the Commit phase parameter are detected. If a defect is found, a risk level is output according to a preset risk scoring library, the protocol implementation defect is identified and responded to in a timely manner, and the system security is enhanced.

[0031] Optionally, the dynamic threshold adjustment further comprises:

[0032] A baseline threshold is calculated based on the historical handshake failure times of the radio product hardware in each frequency band.

[0033] When it is detected that the number of handshake failures of the device in a specific frequency band continuously exceeds the baseline threshold of a preset window time, the hardware logic automatically adjusts the upper limit of the dynamic threshold of the specific frequency band.

[0034] If the alarm is still continuously triggered after the dynamic threshold is adjusted, it is marked as an abnormal mode and pushed to a security management platform, and a de-authentication frame is sent to the target device through a hardware interface and abnormal logs are recorded.

[0035] By adopting the technical scheme, the baseline threshold is calculated by analyzing the historical handshake failure times of each frequency band, when a specific frequency band continuously exceeds the baseline threshold, the hardware automatically adjusts the upper limit of the dynamic threshold. If the alarm continues, it is marked as an abnormal mode, pushed to the security management platform, and the de-authentication frame is sent through the hardware interface and the log is recorded, to ensure timely detection and response to potential attacks and improve system security.

[0036] Optionally, the method further comprises:

[0037] Based on the corresponding risk score driving strategy selection: if the risk score is high risk, the hardware module immediately triggers the de-authentication frame and blocks the current frequency band connection, and at the same time forces to refresh the hardware key; if the risk score is medium risk, the WPA3-SAE capability negotiation request is sent to the target device and the observation log is recorded; if the risk score is low risk, only the log is recorded and continuous monitoring is performed;

[0038] If it is detected that the device triggers a high-risk event in the 6GHz frequency band, the handshake verification frequency in the 2.4GHz and 5GHz frequency bands is increased synchronously.

[0039] By adopting the technical scheme, based on the risk score, when the risk is high, the hardware module immediately triggers the de-authentication frame and refreshes the key, when the risk is medium, the WPA3-SAE capability negotiation request is sent and the log is recorded, and when the risk is low, only the log is recorded and continuous monitoring is performed. If a high-risk event occurs in the 6GHz frequency band, the handshake verification frequency in the 2.4GHz and 5GHz frequency bands is increased synchronously, to ensure rapid response and prevention of potential threats and improve the overall security of the system.

[0040] In a second aspect, the present application provides a device for detecting wireless network security, which adopts the following technical scheme:

[0041] A device for detecting wireless network security, comprising:

[0042] A four-time interaction data extraction module, which captures the wireless communication traffic of the 2.4GHz, 5GHz and 6GHz frequency bands in real time through the hardware module of the wireless radio product, and performs protocol analysis on the wireless communication traffic, for extracting the four-time interaction data of the device performing the WPA3 SAE handshake protocol in each frequency band, wherein the four-time interaction data includes the Commit message, the Confirm message, the PMK generation parameter and the hash check value;

[0043] A consistency verification module compares SAE handshake processes of each frequency band to verify consistency of hardware generation logic, and in the process of verifying the consistency of the hardware generation logic, whether the hardware random number is unique is judged, and whether the Confirm hash value is matched is judged; the number of handshake failures in each frequency band is counted, and if the number of handshake failures in any frequency band exceeds a preset dynamic threshold, it is determined as a potential attack behavior; it is detected whether abnormal frames of the WPA2 authentication mode appear in the 6GHz frequency band, and if detected, an alarm is triggered;

[0044] An anomaly detection module is configured to automatically send a deauthentication frame by the hardware module of the wireless radio product when detecting an abnormal number of handshake failures, to forcibly disconnect the connection of the target device and trigger a re-handshake process; if abnormal frames of the WPA2 compatible mode are detected in the 6GHz frequency band, the wireless communication function of the 6GHz frequency band is immediately disabled through the hardware interface configuration;

[0045] A risk score output module defines hard rules according to the SAE handshake protocol specification supported by the wireless radio product hardware, including: the Commit message must contain a hardware-generated unique random number and cannot be repeated, the hash value of the Confirm message must be consistent with the hardware parameters in the Commit phase, and the PMK generation must be based on a hardware-level dynamic key exchange algorithm; if any rule is violated, it is determined as a protocol implementation defect or an attack behavior, and a corresponding risk score is output, wherein the risk score corresponds to high risk, medium risk and low risk;

[0046] A defense strategy adjustment module dynamically adjusts the defense strategy according to the risk score: if it is high risk, the PMK is refreshed or the high-risk frequency band is disabled through the hardware key management module; if it is medium risk, the device protocol compatibility is verified through the firmware-level capability negotiation request; if it is low risk, only the abnormal event and defense action log are recorded through the hardware logger.

[0047] In a third aspect, the present application provides a device for detecting wireless network security, which adopts the following technical solution:

[0048] A device for detecting wireless network security, comprising a processor, wherein the processor runs a program of the method for detecting wireless network security according to any one of the above.

[0049] In a fourth aspect, the present application provides a storage medium, which adopts the following technical solution:

[0050] A storage medium stores a program of the method for detecting wireless network security according to any one of the above.

[0051] In summary, the present application includes at least one of the following beneficial technical effects:

[0052] The wireless communication traffic of 2.4GHz, 5GHz and 6GHz frequency bands is captured in real time through the hardware module of the radio product, the four interaction data of the WPA3-SAE handshake protocol is analyzed, the consistency of the hardware generation logic is verified, including the uniqueness of the random number and the matching of the Confirm hash value. The number of handshake failures in each frequency band is detected through dynamic threshold, and the WPA2 abnormal frame in the 6GHz frequency band is identified, so as to realize the rapid response to potential attack behaviors, such as triggering the de-authentication frame or disabling the high-risk frequency band, thereby realizing the real-time security monitoring.

[0053] Further, the system dynamically adjusts the defense strategy based on the risk score, supports differentiated processing under high, medium and low risks, such as forced key refreshing, protocol negotiation or log recording. At the same time, combined with cross-frequency protocol consistency verification, blacklist isolation, multi-frequency collaborative attack identification and other mechanisms, the overall defense capability is improved, and efficient, real-time and adaptive detection and protection of security threats to wireless network equipment are ensured. BRIEF DESCRIPTION OF DRAWINGS

[0054] Figure 1 is a flow chart of a method for detecting wireless network security according to an exemplary embodiment.

[0055] Figure 2 is a structural block diagram of a device for detecting wireless network security according to an exemplary embodiment. DETAILED DESCRIPTION

[0056] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings.

[0057] In the description of the present specification, the description of the terms "certain embodiments", "one embodiment", "some embodiments", "illustrative embodiments", "example", "specific example" or "some examples" means that the specific features, structures, materials or characteristics described in connection with the described embodiments or examples are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0058] The embodiments of the present application disclose a method for detecting wireless network security, referring to Figure 1 , comprising:

[0059] S100, real-time capture wireless communication traffic in 2.4GHz, 5GHz and 6GHz bands through hardware modules of radio products, protocol analysis of wireless communication traffic, and extraction of four interaction data of WPA3 SAE handshake protocol executed by devices in each frequency band, wherein the four interaction data includes Commit message, Confirm message, PMK generation parameter and hash check value.

[0060] The detailed execution steps of S100 specifically include the following sub-steps:

[0061] Step 1, enable the listening function of 2.4GHz, 5GHz and 6GHz bands through the hardware module (such as Wi-Fi 7 compatible radio frequency front end or embedded detection chip) of the radio product. The hardware module must have hardware-level multi-band concurrent capability to ensure synchronous capture of wireless communication traffic on the three frequency bands.

[0062] In the embodiment of the application, the hardware is configured: enable the hardware mixed mode in the radio product to receive all passing wireless data frames (including management frames, control frames and data frames); configure a multi-band listening mode to ensure compatibility with devices of different protocol versions.

[0063] In the embodiment of the application, the traffic capture: real-time capture of wireless traffic in each frequency band using hardware built-in packet capture tool; set filtering rules to screen WPA3 SAE handshake related data packets (such as authentication frames, data frames).

[0064] Step 2, protocol analysis and four interaction data extraction, protocol analysis of captured raw traffic, and extraction of four interaction data (Commit, Confirm, PMK generation parameter, hash check value) of WPA3 SAE handshake protocol.

[0065] Commit message analysis: extract the Commit message exchanged between the client and the access point from the first stage of the SAE handshake process; verify whether the Commit message contains a random number that meets the specification and record its uniqueness (such as detecting repeatability through hash table); extract the public key and encryption parameters (such as key exchange algorithm type) in the Commit message.

[0066] Confirm message analysis: analyze the Confirm message of the second stage and extract the hash value; verify whether the Confirm hash value is consistent with the parameters (such as random number, public key, shared key) of the Commit stage to ensure that the key generation logic of both parties matches (such as recalculating the expected value through a hash function and comparing).

[0067] PMK generation parameter extraction: Extract key parameters (e.g., key exchange result, hash algorithm type) used to generate Pairwise Master Key (PMK) from Commit and Confirm messages; verify whether PMK generation complies with dynamic key exchange specifications (e.g., whether based on shared key exchange results by both parties).

[0068] Hash check value extraction: Extract the hash check value in the Confirm message and compare it with the expected value calculated locally to determine whether the handshake process is complete and has not been tampered with.

[0069] Step 3, multi-band data association and storage: Associate SAE handshake data of the same device in different frequency bands (2.4 GHz, 5 GHz, 6 GHz) by timestamp to form a multi-dimensional data set.

[0070] Device identification binding: Match the interaction data of the same device in different frequency bands through device MAC address or service set identifier (SSID).

[0071] Timing alignment: Synchronize the handshake process of each frequency band based on the timestamp to ensure consistency in cross-frequency band analysis (e.g., detect whether the device initiates a handshake in the 6 GHz frequency band and then immediately switches to the 2.4 GHz frequency band).

[0072] Data storage optimization: Store the parsed four interaction data (Commit, Confirm, PMK parameter, hash check value) in a structured format (e.g., database table) for subsequent analysis.

[0073] It should be noted that in the embodiments of the present application, the following key indicators are monitored in real time during the capture and analysis process: handshake failure count statistics, record handshake failure events in each frequency band, and count the number of failures per unit time; if the number of handshake failures in any frequency band exceeds the preset dynamic threshold (e.g., the number of failures in 5 minutes > 10 times), it is marked as a potential attack behavior; WPA2 authentication mode anomaly detection, screening abnormal frames of WPA2 authentication mode in the 6 GHz frequency band, if detected, trigger an alarm.

[0074] Through the multiple sub-steps in S100, the hardware-level real-time traffic capture and protocol analysis of the radio product are used to build a comprehensive data foundation for subsequent wireless network security detection. Its role is reflected in: covering the traffic collection of 2.4GHz, 5GHz and 6GHz frequency bands, ensuring that the attack behavior of mainstream Wi-Fi devices (especially Wi-Fi6 / 7) is monitored without blind spots; accurately extracting the four-way interaction data of WPA3 SAE handshake (such as Commit message, Confirm hash value, PMK parameter), verifying the compliance of the handshake process, and providing the basis for protocol version conflict detection, PMK consistency verification and attack identification; through time sequence association and structured storage, forming a closed-loop logic of cross-frequency band protocol analysis, handshake failure statistics and risk score calculation; synchronously analyzing multi-frequency band data, providing collaborative defense support for frequency band isolation strategy, dynamic threshold adjustment and cross-frequency band attack mode identification (such as induced degradation attack), so as to realize efficient detection and response to complex attack scenarios.

[0075] In S200, the SAE handshake processes of different frequency bands are compared to verify the consistency of the hardware generation logic. In the process of verifying the consistency of the hardware generation logic, whether the hardware random number is unique and whether the Confirm hash value is matched are judged; the number of handshake failures in each frequency band is counted, and if the number of handshake failures in any frequency band exceeds the preset dynamic threshold, it is determined as a potential attack behavior; it is detected whether there are abnormal frames of WPA2 authentication mode in the 6GHz frequency band, and if detected, an alarm is triggered.

[0076] The detailed execution steps of S200 include the following multiple sub-steps:

[0077] Step 1, compare the SAE handshake processes of different frequency bands to verify the consistency of the hardware generation logic:

[0078] Data extraction and comparison: compare the SAE handshake interaction data (Commit message, Confirm message, PMK parameter, hash check value) of each frequency band (2.4GHz, 5GHz, 6GHz) extracted in S100.

[0079] Commit message verification: check whether the Commit message sent by the device in each frequency band contains a unique random number (SCN) generated by the radio product hardware. If the same device sends repeated SCN in different frequency bands, it is marked as abnormal behavior.

[0080] Confirm hash value matching: compare the hash value in the Confirm message with the parameters (such as SCN, public key, shared key) in the Commit phase to determine whether they are consistent. If they are not consistent, it is determined that the handshake process is abnormal, which may cause hardware-level PMK generation error.

[0081] PMK generation logic verification: Verify whether the PMK generation in each frequency band is based on the same hardware-level dynamic key exchange algorithm (such as ECDH). If it is detected that the PMK generation parameters of a certain frequency band do not conform to the standard specification (such as inconsistent algorithm type), it is marked as a protocol implementation defect.

[0082] Step 2, count the number of handshake failures in each frequency band and determine potential attack behavior:

[0083] Failure count: Record the number of failures (such as device non-response, hash check failure, SCN conflict, etc.) from the handshake events of each frequency band. The statistical period can be based on a time window (such as within 5 minutes);

[0084] Dynamic threshold determination: Compare the actual number of failures with the preset dynamic threshold (based on historical baseline calculation). If the number of failures of a certain frequency band exceeds the threshold (such as the number of failures within 5 minutes > 10 times), it is determined as potential attack behavior (such as replay attack, fake handshake frame);

[0085] Attack behavior marking: Mark the frequency band and device that triggered the threshold, and record the abnormal event log (such as timestamp, device MAC address, frequency band identifier).

[0086] Step 3, detect WPA2 authentication mode abnormal frames in 6GHz frequency band:

[0087] Protocol version field identification: In the traffic of 6GHz frequency band, filter the authentication frames and extract the protocol version field (such as WPA2, WPA3);

[0088] Abnormal frame detection: If it is detected that there are WPA2 authentication mode frames (such as WPA2-PSK or WPA2-ENT) in the 6GHz frequency band, it is determined as protocol version abnormality, which may be an attempt by the attacker to induce device downgrade;

[0089] Alarm triggering: Immediately send an alarm signal to the security management platform, record the detailed information of the abnormal frame (such as time, device MAC address, protocol version), and trigger the subsequent defense strategy (such as frequency band isolation);

[0090] S200 step realizes the active detection of multi-band wireless network attacks through the depth comparison and protocol verification of cross-band SAE handshake process. That is, the hardware consistency of each band PMK generation logic (such as Commit random number uniqueness, Confirm hash value matching) is verified to ensure that the handshake process meets the WPA3 SAE specification; based on the dynamic threshold analysis of the number of handshake failures, potential attacks (such as replay attacks, fake handshake) are accurately identified; WPA2 abnormal frames in the 6GHz band are detected to prevent protocol downgrade attacks; finally, the verification results (such as protocol conflict, attack marking) are transmitted to the subsequent steps to drive the dynamic adjustment of the defense strategy (such as blocking connection, refreshing PMK), forming a closed-loop logic from attack identification to response, and fully guaranteeing the wireless network security in the multi-band environment.

[0091] S300, when the number of handshake failures is detected to be abnormal, the hardware module of the wireless radio product automatically sends a deauthentication frame to forcibly disconnect the connection of the target device and trigger a re-handshake process; if the 6GHz band detects an abnormal frame in the WPA2 compatible mode, the wireless communication function of the 6GHz band is immediately disabled through the hardware interface configuration.

[0092] The detailed execution steps of S300 step specifically include the following sub-steps:

[0093] Step 1, detect handshake failure number anomaly and trigger deauthentication frame:

[0094] When the number of handshake failures of a certain band (such as 2.4GHz, 5GHz) exceeds the preset dynamic threshold (such as the number of failures within 5 minutes > 10 times), the hardware module of the wireless radio product will automatically trigger the defense action.

[0095] Abnormality determination: based on the statistical results of S200 step, if the handshake failure event of a certain band is marked as potential attack behavior (such as replay attack, fake handshake frame), the response process is entered.

[0096] Send deauthentication frame: the hardware-level radio frequency control unit of the wireless radio product sends a deauthentication frame (DeauthenticationFrame) to the target device (such as the attack source device or the attacked device) to forcibly disconnect its connection with the access point (AP); the sending of the deauthentication frame needs to comply with the 802.11 protocol specification, including device MAC address, reason code (such as "class 2 error: protocol violation") and other fields to ensure legitimacy and traceability.

[0097] Trigger re-handshake: after forcibly disconnecting the connection, the target device will try to re-initiate the handshake process. The system monitors the new handshake process through S100 and S200 steps to determine whether there is still an abnormality.

[0098] Step 2, detect WPA2 compatible mode in 6GHz band and block connection: if abnormal frames of WPA2 authentication mode (such as WPA2-PSK or WPA2-ENT) are detected in 6GHz band, the hardware interface of the wireless radio product will immediately perform frequency band isolation operation.

[0099] Protocol version check: on the basis of step S200, further verify whether the authentication frame of 6GHz band conforms to WPA3 SAE specification; if WPA2 protocol frame (such as WPA3 is not declared in RSNIE field) is detected, it is determined as protocol downgrade attack.

[0100] Frequency band isolation and blocking: the hardware interface controller of the wireless radio product will immediately close the wireless communication function of 6GHz band, preventing the attacker from penetrating by using the old protocol version.

[0101] The configuration mode can include: closing 6GHz band in the radio frequency interface view of the AP (such as executing shutdown command under radio6 interface). The closing mode can also be realized by hardware register writing, radio frequency channel control signal, etc., instead of relying on software level AP configuration instruction.

[0102] It should be pointed out here that the traffic of this frequency band is blocked by policy rules (such as ACL or VLAN isolation). In addition, in the embodiment of the present application, the dynamic recovery mechanism: set a timer or based on the health check mechanism, re-enable 6GHz band after a preset time (such as 10 minutes), and continuously monitor the protocol version compliance.

[0103] Step 3, all defense operations need to be recorded to the security log system synchronously for subsequent analysis and audit.

[0104] Log content: event type, explicitly marked as "handshake failure abnormal response" or "WPA2 compatible mode blocking"; timestamp, record the specific time of defense action triggering (such as 2025-06-2302:13:35); device information, including MAC address of target device, frequency band (such as 6GHz), AP identification, etc.; defense action details, such as the number of deauthentication frames sent, 6GHz band blocking state change record.

[0105] Log storage and alarm: synchronize the log to the centralized log server (such as ELKStack or Splunk), and trigger notification (such as email, SMS or enterprise internal IM tool) through the firmware level alarm interface of the wireless radio product.

[0106] In the S300 step, the abnormal handshake behavior and protocol version conflict detected in the S200 are responded in real time through a hardware-level active defense mechanism of the radio product; an automatic deauthentication frame is sent through a hardware module to forcibly disconnect the connection of an abnormal device and block the link of an attacker using a handshake vulnerability (such as a replay attack or a fake identity); for the abnormal WPA2 compatible mode of the 6GHz frequency band, the communication of the frequency band is directly disabled through a hardware interface to prevent a protocol downgrade attack; a closed-loop process from attack detection to defense action is formed by combining hardware log recording and a firmware-level alarm interface to provide data support for traceability analysis and strategy optimization; the overall anti-attack capability of the wireless network in a multi-frequency band environment is enhanced through cross-frequency band isolation and recovery strategies (such as dynamically disabling / enabling the 6GHz frequency band), so as to achieve the cooperative goals of rapid response, accurate blocking, and dynamic protection.

[0107] In the S400, hard rules are defined according to the SAE handshake protocol specification supported by the hardware of the radio product, including that the Commit message must contain a unique random number generated by the hardware and cannot be repeated, the hash value of the Confirm message must be consistent with the hardware parameters in the Commit phase, and the PMK generation must be based on a hardware-level dynamic key exchange algorithm; if any rule is violated, it is determined that there is a protocol implementation defect or an attack behavior, and a corresponding risk score is output, wherein the risk score corresponds to high risk, medium risk, and low risk.

[0108] The detailed execution steps of the S400 step specifically include the following sub-steps:

[0109] Step 1: Based on the data (such as handshake interaction records, attack markers, and defense action logs) collected in the S100 to S300 steps, a structured security report is generated.

[0110] In the embodiments of the present application, the report content mainly includes:

[0111] Attack event statistics: key indicators such as the number of handshake failures, the number of deauthentication frame transmissions, and the number of WPA2 abnormal frame detections of each frequency band (2.4GHz, 5GHz, and 6GHz) are summarized; time trend analysis: an attack event density graph is drawn with an hour / day as a time window to identify high-risk periods (such as frequent replay attacks at night); device behavior portrait: for high-frequency abnormal devices (such as MAC addresses), their attack modes (such as repeatedly sending Commit messages or attempting protocol downgrade) are labeled.

[0112] In the embodiments of the present application, the report format adopts visual forms such as tables, line graphs, and heat maps to facilitate administrators to quickly locate problems, and in addition, the output format of the report format supports PDF, HTML, or integration into an enterprise security management system (such as a SOC platform).

[0113] Step 2: Model historical attack data using machine learning models (such as time series analysis or clustering algorithms) to predict potential future risks.

[0114] By inputting the attack frequency, frequency band distribution, and defense action response time recorded in steps S100 to S300, and based on dimensions such as attack type (e.g., replay attack weight > protocol degradation attack), frequency band importance (6GHz > 5GHz > 2.4GHz), and attack duration, combined with the compliance verification results of the radio product's own protocol, the risk scoring model dynamically calculates the risk score (e.g., 0-100 points) of the device or frequency band. If it is high risk, the high risk score triggers an automatic alarm (e.g., when the score is >80, it is pushed to the administrator or firmware-level alarm interface). In this embodiment of the application, an attack probability heatmap for the next 24 hours can be generated to assist in formulating a defense strategy adjustment plan.

[0115] Step 3: Based on the changes in attack patterns and feedback on defense effectiveness, propose targeted strategy optimization suggestions.

[0116] Dynamic threshold adjustment: If the number of handshake failures in a certain frequency band is consistently lower than the preset threshold, it is recommended to reduce the detection sensitivity to reduce false alarms; if a new attack mode (such as short-duration high-frequency commit messages) appears in a high-frequency band (such as 6GHz), it is recommended to temporarily tighten the threshold.

[0117] Defense strategy adjustments: For specific attack types (such as protocol downgrade attacks), it is recommended to enable stricter protocol version verification (such as mandatory WPA3-SAE); for high-frequency abnormal devices, it is recommended to add them to the blacklist or restrict their access frequency bands (such as only allowing access to 5GHz).

[0118] Automated deployment recommendation: Automatically distribute the optimized policies to the configuration modules of radio products (such as radio frequency control registers and key management units) via scripts or API interfaces.

[0119] Step 4, the system adaptive adjustment and feedback loop, that is, feeding back the analysis results of S400 to steps S100 to S300 to form a closed-loop optimization.

[0120] Parameter update: Synchronize the weight parameters (such as attack type weight) output by the risk scoring model to the dynamic threshold calculation module of S200; automatically add the MAC addresses of high-frequency abnormal devices to the fast blocking whitelist of S300.

[0121] Policy deployment: Update the configuration policies (such as protocol version verification rules and handshake process verification items) of radio products in batches through automated tools (such as embedded scripts or firmware update mechanisms).

[0122] In addition, in the S100 step, a monitoring item for the optimized strategy (such as a newly deployed protocol version verification rule) is added to ensure that the strategy takes effect and continuously assesses the effect.

[0123] The S400 step builds a complete risk identification and response system through a compliance verification mechanism based on a radio product hardware protocol, combined with data analysis and an intelligent scoring model. The core role is to: build a comprehensive security situation awareness capability to intuitively display attack distribution, frequency band risk, and device behavior characteristics; use machine learning to achieve intelligent risk prediction, dynamically calculate risk scores, and identify potential threats in advance; promote adaptive optimization of defense strategies, adjust detection thresholds, protocol restrictions, and access control strategies according to changes in attack patterns; and through a closed-loop system coordination mechanism, feedback the analysis results to the detection and defense modules to form a complete security closed loop of "collection-analysis-response-optimization", continuously improving the protocol security and attack resistance of radio products in a multi-frequency band environment.

[0124] S500, dynamically adjust the defense strategy according to the risk score: if it is high risk, prefer to refresh the PMK or disable the high-risk frequency band through the hardware key management module; if it is medium risk, verify the device protocol compatibility through the firmware-level capability negotiation request; if it is low risk, only record abnormal events and defense action logs through the hardware logger.

[0125] The detailed execution steps of the S500 step specifically include the following sub-steps:

[0126] Step 1, build a long-term security trend database, structure all the security event data (such as handshake interaction records, attack markers, defense action logs, risk scores) collected in the S100 to S400 steps to form a long-term trend database.

[0127] Data classification: divide attack event density, handshake failure times, defense response frequency, etc. according to time dimension (such as hour, day, week); record the abnormal behavior patterns of the device (such as high-frequency Commit message, protocol downgrade attempt) according to the device dimension (such as MAC address, frequency band).

[0128] Storage optimization: use the embedded database supported by the radio product (such as lightweight SQLite or FlashDB) to store massive data, support fast query and real-time analysis; in addition, indexes need to be established for key fields (such as timestamp, device MAC address, risk level) to improve retrieval efficiency.

[0129] Step 2, multi-dimensional security trend analysis, that is, based on the long-term trend database, the security state of the wireless network is deeply analyzed to identify potential threat patterns.

[0130] It is worth noting that for attack pattern mining, clustering algorithms such as K-means can be used to cluster high-frequency attack events such as replay attacks and fake handshakes, and extract attacker behavior characteristics such as attack time distribution and target device preference.

[0131] Through association rule mining such as Apriori algorithm, the association between attack events and device behavior is found (such as a device frequently triggers de-authentication frames in the 6GHz frequency band, and protocol downgrade attacks appear in the 5GHz frequency band).

[0132] Step 3, according to the trend analysis result, automatically generate and deploy the optimized security policy, realize the self-evolution of the defense system.

[0133] Policy generation: If high-risk events are detected (such as WPA2 abnormal frames + PMK generation anomaly), the system automatically triggers the hardware key management module to refresh PMK, or directly disables high-risk frequency band communication; For medium-risk events (such as Confirm hash value deviation but not violating protocol specification), verify whether the device supports WPA3-SAE through firmware-level capability negotiation request to prevent misjudgment; For low-risk events (such as timestamp slight deviation, non-standard frame format), only the hardware logger records event details, without interrupting the connection.

[0134] Policy deployment: Through the firmware update mechanism or configuration register interface of the wireless radio product, the policy change is issued to the local module (such as the key management unit, the radio frequency control unit); Real-time monitoring of policy effectiveness (such as checking whether PMK is successfully refreshed, whether the frequency band is closed), and recording deployment logs.

[0135] Step 4, present the long-term trend analysis and policy optimization results in a visual form to provide decision support for management. In the embodiments of the present application, the visual content includes:

[0136] Attack heat map, showing the attack density distribution and high-risk period of each frequency band (2.4GHz, 5GHz, 6GHz); Strategy performance dashboard, real-time display of defense strategy response efficiency (such as PMK refresh success rate, protocol compatibility negotiation success rate).

[0137] In addition, in the embodiments of the present application, for security reports, they are generated periodically, and the period can be adjusted, that is, periodic security reports (such as monthly / quarterly) are generated, including attack trend analysis, defense strategy optimization suggestions and resource allocation suggestions, the report supports multi-format export (PDF, HTML), and is integrated into the security management platform (such as SOC, SIEM system) through the firmware-level log upload interface.

[0138] Through the differentiated defense strategy based on the risk score, combined with data analysis and intelligent decision model, the precise response of wireless radio products in different security situations is realized: high risk triggers hardware level PMK refresh or band isolation, medium risk verifies protocol compatibility through firmware level capability negotiation, low risk only records log to ensure system stability, and finally forms a closed-loop logic of "collection-analysis-response-optimization", continuously improving the anti-attack resilience and intelligent protection capability of the product.

[0139] In the embodiment of the present application, in the cross-band protocol consistency verification module, further comprising:

[0140] Step 1, by comparing the hardware protocol version fields of the wireless radio product in different frequency bands, the protocol consistency of each frequency band is verified. The system extracts the protocol version field (such as WPA3-SAE identifier in RSNIE field) in the SAE handshake frame sent by the device in different frequency bands (such as 2.4GHz, 5GHz, 6GHz) through the hardware parsing module of the wireless radio product, and performs cross-band comparison.

[0141] The conflict detection logic of the present scheme is: if it is detected that the protocol version fields of at least two frequency bands are inconsistent (for example, 2.4GHz band declares support for WPA3 SAE, while 6GHz band declares use of WPA2 PSK), then it is marked as a protocol version conflict event. It should be pointed out that this conflict detection logic has been mentioned in the "protocol consistency guarantee" of S200 step (such as PMK generation algorithm verification), but here it is further refined as a comparison mechanism based on hardware protocol version field, to ensure that the protocol compliance is judged from the perspective of the wireless radio product itself.

[0142] Step 2, based on the protocol version conflict event, generate frequency band isolation strategy and execute.

[0143] The system writes the frequency band (such as 6GHz) with protocol version conflict into the hardware blacklist storage unit of the wireless radio product, and prohibits the frequency band from initiating a new SAE handshake process. This isolation mechanism is similar to the "blacklist mechanism" of S300 step, but here it is extended to a special processing logic for protocol version conflict, which is directly executed by the hardware level radio frequency control module of the wireless radio product, rather than relying on external configuration.

[0144] Step 3, send a hardware level WPA3-SAE capability negotiation request to the target device to verify whether it supports the latest protocol version.

[0145] Negotiation process: if the device fails to respond (such as not returning WPA3-SAE confirmation information), it is determined that there is a protocol downgrade risk; deauthentication frame trigger: the hardware level radio frequency control unit of the wireless radio product sends a deauthentication frame (DeauthenticationFrame) to the target device to forcibly disconnect.

[0146] It should be noted that the protocol downgrade risk event will be recorded to the firmware-level logger of the radio product, including the timestamp, device MAC address, frequency band identifier, protocol version information, and defense action details, for subsequent analysis and alarm use.

[0147] That is, after a device completes the handshake through WPA3-SAE in the 2.4 GHz frequency band, the attacker attempts to induce it to initiate a connection using the WPA2 protocol in the 6 GHz frequency band; the hardware parsing module of the radio product discovers that the 6 GHz frequency band declares the use of WPA2-PSK by comparing the protocol version fields (such as the WPA3-SAE identifier in the RSNIE) of the two frequency bands, triggering a protocol version conflict event. Subsequently, the system writes the 6 GHz frequency band to the hardware blacklist and disables communication in the frequency band, while sending a hardware-level WPA3-SAE capability negotiation request. If the device does not respond or returns an error (such as still insisting on using WPA2), the hardware-level radio frequency control unit of the radio product immediately triggers a deauthentication frame to forcibly disconnect the connection, and records a protocol downgrade risk event through the firmware-level logger. This process is linked with the frequency band isolation strategy of S300 and the protocol consistency check of S200, ultimately blocking the path of the attacker's penetration through protocol version downgrade, and ensuring the security of the protocol in a multi-frequency band environment.

[0148] In the embodiments of the present application, in the frequency band isolation strategy, it further includes:

[0149] Step 1: After detecting the protocol version conflict event, the hardware-level security control module of the radio product writes the MAC address of the conflicting device and the frequency band identifier (such as 2.4 GHz, 5 GHz, 6 GHz) to the hardware blacklist storage unit.

[0150] Blacklist storage logic: It should be noted that the blacklist mechanism here is different from the "disable wireless connection in the 6 GHz frequency band" logic mentioned in the "frequency band isolation and blacklist mechanism" of S300 step, which is further refined as a device-level blacklist, that is, only restricts the access permission of a specific device in a specific frequency band, rather than globally disabling the entire frequency band; for example: if a device triggers a protocol version conflict event in the 6 GHz frequency band, the system will record its MAC address and 6 GHz frequency band identifier to avoid subsequent connection initiation in the frequency band.

[0151] Step 2: When detecting that the device initiates a new SAE handshake request in the blacklisted frequency band, the hardware module automatically discards the request and records the interception log.

[0152] Intercept logic: This operation is different from the "send de-authentication frame" of S300 step, where the interception occurs at an earlier stage of the handshake process (such as before the Commit message is sent), directly discarding the request rather than passively disconnecting; for example: if a device has been marked as a 6GHz blacklist, its Commit message will be directly discarded by the hardware-level RF control unit of the wireless product, without entering the Confirm phase or triggering the de-authentication frame.

[0153] Step 3, if the device is subsequently detected to successfully complete the WPA3-SAE handshake in the blacklisted frequency band, its blacklist identification in that frequency band is automatically removed.

[0154] Dynamic removal logic: If a device has been added to the blacklist in the 6GHz frequency band due to protocol version conflict, but subsequently passes the compliant WPA3-SAE handshake verification, the firmware-level security management module of the wireless product will automatically remove it from the blacklist, allowing it to access normally.

[0155] A device has been added to the hardware blacklist storage unit in the 6GHz frequency band due to protocol version conflict (declares using WPA2 instead of WPA3 SAE). When the device attempts to initiate an SAE handshake request in the 6GHz frequency band again, the hardware-level RF control unit of the wireless product directly discards its Commit message and records the interception log (instead of waiting for the complete handshake process), effectively preventing attackers from exploiting old protocol vulnerabilities. If the device subsequently passes the compliant WPA3-SAE handshake verification in the 6GHz frequency band (such as successfully sending a Confirm message), the firmware-level security management module of the wireless product automatically removes it from the blacklist, allowing it to access normally. This process combines the frequency band isolation strategy (global frequency band blocking) of S300 and the protocol consistency verification (protocol version field comparison) of S200, achieving a "precise interception-dynamic removal" closed-loop protection, which not only avoids mistakenly harming legitimate devices, but also ensures the security of the protocol in a multi-frequency band environment.

[0156] In the embodiments of the present application, the method further comprises:

[0157] Step 1, based on the hardware-captured frequency band isolation action and the log of the protocol version conflict event, identify whether the attacker implements the attack through multi-frequency band coordination (such as switching to the 2.4GHz frequency band after inducing the device to downgrade in the 6GHz frequency band) through timestamp association analysis.

[0158] The hardware-level logger of the radio product collects timestamp data of band isolation actions (such as sending de-authentication frames, writing blacklists) and protocol version conflict events, and the system analyzes attack behavior patterns through time series comparison; for example, if a device triggers a protocol version conflict event (timestamp T1) in the 6 GHz frequency band, then initiates an abnormal handshake request (timestamp T2) in the 2.4 GHz frequency band, and T2-T1 is within the preset threshold (such as 30 seconds), it is determined as a coordinated attack behavior (such as "induced degradation + cross-frequency penetration").

[0159] Step 2, dynamically optimize hardware isolation strategy according to association analysis results.

[0160] Strategy adjustment logic: if it is detected that the attacker induces degradation through the 6 GHz frequency band and then switches to the 2.4 GHz frequency band, the hardware-level radio frequency control module of the radio product dynamically adjusts the isolation strategy: then add the 2.4 GHz frequency band to the temporary isolation list, and reduce its handshake failure threshold (such as the dynamic threshold adjustment logic of S200); if the device has multiple cross-frequency abnormal behaviors, mark its MAC address as high risk, and extend to full-band isolation.

[0161] Step 3, optimize blacklist update rules based on the characteristics of coordinated attack behavior.

[0162] Rule optimization logic: if a device is marked multiple times due to coordinated attack behavior, the firmware-level security management unit of the radio product automatically adjusts the blacklist aging strategy: shortens the blacklist aging time from the default 30 minutes to 5 minutes, increases the cross-frequency behavior penalty weight, and improves the subsequent connection request interception priority; record the characteristics of coordinated attack, which is used for subsequent machine learning model training and risk scoring model optimization (such as the linkage of S400 and S500 steps).

[0163] An attacker induces a device to downgrade from WPA3 SAE to WPA2 protocol via 6GHz band (timestamp T1), and then initiates an abnormal handshake request in 2.4GHz band (timestamp T2), with a T2-T1 interval of only 15 seconds. Through timestamp correlation analysis, the hardware-level log recorder of the wireless radio product identifies the coordinated attack behavior in the two bands, and determines it as a "protocol downgrade induction + cross-band penetration" attack. Subsequently, the hardware-level radio frequency control module dynamically adjusts the strategy: strengthens the handshake failure threshold of the 2.4GHz band (S200 dynamic threshold adjustment), and adds the MAC address of the device to the hardware blacklist together with the 6GHz band (S300 blacklist mechanism). If the device attempts to connect again in the 2.4GHz band later, the system will automatically shorten its blacklist aging time to 5 minutes due to the cross-band behavior marking (S500 dynamic trust recovery), and record the high-risk behavior by the firmware-level security management unit. Through the closed-loop logic of "timestamp correlation - strategy response - rule evolution", this process precisely blocks the attack path, and optimizes the defense system's ability to resist complex coordinated attacks.

[0164] In the embodiments of the present application, the method further comprises a defect detection step based on protocol analysis:

[0165] Step 1: The system uses the hardware-level protocol analysis unit of the wireless radio product to perform field-level deep analysis on the key frames such as Commit messages and Confirm messages sent by the target device during the SAE handshake process, and extracts the following parameters: hardware random number (Scalar / Element value) in the Commit message; hash value (ConfirmHash) in the Confirm message; and key parameters (such as Scalar / Element combination in the Commit phase) relied on by PMK generation. These fields are extracted and verified in real time by the hardware-level protocol analysis engine of the wireless radio product, ensuring that the data collection process does not depend on external system or software layer processing.

[0166] Step 2: Based on the extracted parameters, the following hardware protocol implementation defects are detected:

[0167] If the hardware random number is missing (such as Scalar / Element missing) in the Commit message, or the random number conflicts with the historical record (such as reuse), it is determined as a protocol implementation defect; for example: when an attacker forges a Commit message, the old random number may be reused, causing PMK calculation error or triggering cross-band consistency conflict.

[0168] If the hash value of the Confirm message does not match the calculation result of the Commit phase parameters (such as Scalar / Element combination), it is determined that there is a hardware protocol implementation defect; for example: an attacker tampers with the hash value of the Confirm message to bypass the verification process, affecting the security of WPA3-SAE.

[0169] Step 3, according to the detected protocol implementation defect, match the preset risk score library, output the corresponding risk level (such as low risk, medium risk, high risk).

[0170] Risk scoring logic: for example: if the hardware random number is repeated and determined to be "medium risk", the Confirm hash value is inconsistent and determined to be "high risk"; the risk score result will trigger the corresponding defense response action, such as writing to the blacklist, sending de-authentication frames, or dynamically adjusting the isolation strategy.

[0171] Based on the above steps, the hardware random number (Scalar value) in the Commit message sent by a device in the Commit phase of the SAE handshake is repeated with the historical record. The hardware-level protocol analysis engine of the wireless radio product detects this anomaly through field-level analysis and determines that it is a protocol implementation defect, and matches the risk score library to mark it as "medium risk". Subsequently, the system triggers the blacklist mechanism of S300 to add the device to the temporary isolation list and records the risk event. If the device is subsequently detected to have inconsistent hash values in the Confirm phase (such as tampering with the Confirm message), the system upgrades the risk level to "high risk" and triggers de-authentication frames through the hardware-level radio frequency control unit to force disconnection. This process combines the protocol consistency check (protocol version field) of S200 and the dynamic trust recovery mechanism of S500 to realize a complete closed loop from defect detection to risk response.

[0172] In the embodiments of the present application, the dynamic threshold adjustment further includes:

[0173] Step 1, based on the historical handshake failure times of the wireless radio product hardware in each frequency band, calculate the baseline threshold as the basis for dynamic threshold adjustment.

[0174] The system collects the historical handshake failure records of the device in each frequency band (such as 2.4GHz, 5GHz, 6GHz) through the hardware-level statistical module of the wireless radio product, and performs statistical analysis using a sliding window mechanism (such as data within 7 days). The calculation logic is: based on the mean and standard deviation of the number of handshake failures to determine the baseline threshold; for example: the average handshake failure rate of a device in the 6GHz frequency band is 2%, and the standard deviation is 0.5%, so the baseline threshold can be set to 2%+2×0.5%=3%. This baseline serves as the basis for subsequent dynamic threshold adjustment, used to distinguish between normal fluctuations and potential attack behavior.

[0175] Step 2, when the number of handshake failures of the device in a specific frequency band is continuously detected to exceed the baseline threshold of the preset window time, the hardware logic automatically adjusts the upper limit of the dynamic threshold of the specific frequency band (e.g., from 3% to 4%).

[0176] If the handshake failure rate of the device in the 6GHz frequency band exceeds the baseline threshold (e.g., from 3% to 4%) for 3 consecutive hours, the firmware-level strategy control unit of the wireless radio product will automatically raise the upper limit of the dynamic threshold of the frequency band (e.g., from 3% to 4% or 5%) to adapt to short-term abnormal fluctuations; Example: a device caused the handshake failure rate to rise to 4% due to signal interference in the 6GHz frequency band, the system dynamically raises the threshold upper limit of the frequency band to 5%, and observes the subsequent behavior.

[0177] Step 3, if the alarm is still triggered after the dynamic threshold is adjusted, it is marked as an abnormal mode and pushed to the security management platform.

[0178] It should be noted here that if the handshake failure rate of the device in the 6GHz frequency band is still higher than 5% after the dynamic threshold is adjusted, and accompanied by other abnormal behaviors (such as protocol version conflict, Confirm hash verification failure), the hardware-level security decision module of the wireless radio product will determine that it is an abnormal mode and generate a structured event log.

[0179] The event is pushed to the security management platform (such as SIEM system) for manual review, and the hardware-level radio frequency control unit sends a deauthentication frame to the target device to forcibly disconnect and record abnormal logs to the firmware-level log recorder.

[0180] The handshake failure rate of a device in the 6GHz frequency band suddenly rises from the normal value of 2% to 4%, and the baseline threshold calculated by the hardware-level statistical module of the wireless radio product based on historical data is 3%, triggering the firmware-level strategy control unit to raise the upper limit of the dynamic threshold of the frequency band to 5%. If the device still has a handshake failure rate higher than 5% after adjustment due to protocol downgrade attack, the hardware-level security decision module will mark it as an abnormal mode and push it to the security management platform. After the security personnel review, it is found that the device is indeed an attacker who uses old protocol vulnerabilities to induce downgrade, and then the MAC address of the device is permanently banned in the 6GHz frequency band through the blacklist mechanism of S300, and the protocol consistency verification of S200 is linked to strengthen the handshake verification strategy of the 6GHz frequency band. Through the closed-loop logic of "baseline modeling-dynamic adjustment-mode marking-active blocking", the complex attack is accurately identified and quickly responded.

[0181] In the embodiments of the present application, the method further comprises:

[0182] According to the behavior characteristics of the device in the SAE handshake process and the protocol compliance detection result, the system assigns a risk score (high / medium / low) to it, and the hardware-level security decision module of the wireless radio product triggers the corresponding defense strategy:

[0183] If the risk score is high risk (such as inconsistent Confirm hash value, protocol downgrade induction attack): the hardware module immediately triggers a deauthentication frame (Deauthentication Frame) and blocks the current frequency band connection; at the same time, the hardware-level key management unit is started to forcibly refresh the PMK (Pairwise Master Key), preventing the old key from being misused. Example: a device in the 6GHz frequency band is judged to be high risk due to inconsistent Confirm hash value, and the wireless radio product automatically sends a deauthentication frame to force disconnect its connection, refreshes the PMK, and writes its MAC address into the hardware blacklist storage unit (S300).

[0184] If the risk score is medium risk (such as Commit nonce repetition, protocol version field anomaly): the system sends a WPA3-SAE capability negotiation request (Capability Negotiation Request) to the target device through the firmware-level capability negotiation module; verify whether the device supports the latest protocol specification, and record the observation log for subsequent analysis. Example: a device in the 2.4GHz frequency band sends a Commit message with repeated nonce, the system judges it as medium risk, sends a WPA3-SAE capability negotiation request to verify its compliance, and records the negotiation process log.

[0185] If the risk score is low risk (such as slight deviation of protocol field, handshake failure rate below baseline): only record the event details by the firmware-level log recorder, do not interrupt the connection or actively initiate interaction; at the same time, continuously monitor the subsequent behavior of the device to determine whether to upgrade the risk level.

[0186] Step 2, if a device in the 6GHz frequency band triggers a high-risk event, increase the handshake verification frequency in the 2.4GHz and 5GHz frequency bands simultaneously. When a device in the 6GHz frequency band triggers a high-risk event (such as protocol downgrade induction attack), the hardware-level radio frequency control unit of the wireless radio product will link other frequency bands (2.4GHz, 5GHz) to enhance the handshake verification strength: increase the handshake verification frequency (such as adjust the handshake failure threshold from the default value of 5 times to 3 times); shorten the verification interval time (such as check the handshake behavior every 10 seconds), enhance the recognition ability of cross-frequency band coordinated attack.

[0187] Example: A device is determined to be high-risk in the 6GHz frequency band due to a protocol downgrade-induced attack, and the system automatically increases the handshake verification frequency in the 2.4GHz and 5GHz frequency bands, requiring the device to pass a more stringent protocol consistency check when connecting (S200). If the device attempts to connect again in the 2.4GHz frequency band, the system detects that its Commit nonce is repeated (medium risk), sends a WPA3-SAE capability negotiation request and records a log; if the negotiation fails, it is upgraded to high-risk and triggers a deauthentication frame.

[0188] A device sends a SAE handshake frame in the 6GHz frequency band, and the Confirm hash value does not match the Commit parameter (high risk). The hardware-level security decision module of the wireless radio product immediately triggers a deauthentication frame and blocks the connection, and at the same time, the hardware-level key management unit refreshes the PMK to prevent key leakage. At the same time, the hardware-level radio frequency control unit synchronously increases the handshake verification frequency in the 2.4GHz and 5GHz frequency bands, requiring the device to pass a more stringent protocol consistency check when connecting (S200). If the device attempts to connect again in the 2.4GHz frequency band, the system detects that its Commit nonce is repeated (medium risk), sends a WPA3-SAE capability negotiation request and records a log; if the negotiation fails, it is upgraded to high-risk and triggers a deauthentication frame. This process follows the logic chain of "risk scoring - policy selection - cross-frequency linkage", precisely blocking the attack path while reducing the harm to legitimate devices.

[0189] The embodiments of the present application disclose a device for detecting wireless network security, referring to Figure 2 , comprising:

[0190] The four-interaction data extraction module 001 captures wireless communication traffic in the 2.4GHz, 5GHz and 6GHz frequency bands in real time through the hardware module of the wireless radio product, performs protocol analysis on the wireless communication traffic, and extracts four-interaction data of devices performing WPA3 SAE handshake protocol in each frequency band, wherein the four-interaction data includes Commit message, Confirm message, PMK generation parameter and hash check value.

[0191] The consistency verification module 002 compares the SAE handshake processes of each frequency band to verify the consistency of the hardware generation logic, including judging whether the hardware nonce is unique and whether the Confirm hash value matches; counts the number of handshake failures in each frequency band, and if the number of handshake failures in any frequency band exceeds the preset dynamic threshold, it is determined to be a potential attack behavior; detects whether there are abnormal frames of WPA2 authentication mode in the 6GHz frequency band, and if so, triggers an alarm.

[0192] The anomaly detection module 003 is used to automatically send an authentication frame to the wireless product's hardware module when an abnormal number of handshake failures is detected, forcibly disconnecting the target device and triggering a re-handshake process; if an abnormal frame of WPA2 compatible mode is detected in the 6GHz band, the wireless communication function of the 6GHz band is immediately disabled through hardware interface configuration.

[0193] The risk score output module 004 defines hard rules according to the SAE handshake protocol specification supported by the radio product hardware, including: the Commit message must contain a unique random number generated by the hardware and cannot be repeated; the hash value of the Confirm message must be consistent with the hardware parameters in the Commit phase; and PMK generation must be based on a hardware-level dynamic key exchange algorithm. If any rule is violated, it is judged as a protocol implementation defect or attack behavior, and the corresponding risk score is output, where the risk score corresponds to high risk, medium risk, and low risk.

[0194] The defense strategy adjustment module 005 dynamically adjusts the defense strategy based on the risk score: if it is high risk, it will prioritize refreshing the PMK or disabling high-risk frequency bands through the hardware key management module; if it is medium risk, it will verify the device protocol compatibility through firmware-level capability negotiation; if it is low risk, it will only record abnormal events and defense action logs through the hardware log recorder.

[0195] This application also discloses a device for detecting wireless network security, including a processor running a program for the method for detecting wireless network security described in any one of the above embodiments.

[0196] This application also discloses a storage medium storing a program for detecting wireless network security as described in any one of the above embodiments.

[0197] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A method for detecting wireless network security, characterized in that, include: The wireless communication traffic in the 2.4GHz, 5GHz and 6GHz frequency bands is captured in real time by the hardware module of the wireless communication product. The wireless communication traffic is parsed according to the protocol, and the four interaction data of the device executing the WPA3SAE handshake protocol in each frequency band are extracted. The four interaction data include the Commit message, the Confirm message, the PMK generation parameters and the hash verification value. The SAE handshake process of each frequency band is compared to verify the consistency of the hardware generation logic. In the process of verifying the consistency of the hardware generation logic, it is included to determine whether the hardware random number is unique and whether the Confirm hash value matches. The number of handshake failures in each frequency band is counted. If the number of handshake failures in any frequency band exceeds the preset dynamic threshold, it is judged as a potential attack behavior. The abnormal frames of WPA2 authentication mode appear in the 6GHz frequency band. If they are detected, an alarm is triggered. When an abnormal number of handshake failures is detected, the hardware module of the radio product automatically sends an authentication frame to forcibly disconnect the target device and trigger a re-handshake process; if an abnormal frame of WPA2 compatible mode is detected in the 6GHz band, the wireless communication function of the 6GHz band is immediately disabled through hardware interface configuration. The SAE handshake protocol specification supported by the radio product hardware defines hard rules, including: the Commit message must contain a unique random number generated by the hardware and cannot be repeated; the hash value of the Confirm message must be consistent with the hardware parameters in the Commit phase; and PMK generation must be based on a hardware-level dynamic key exchange algorithm. If any rule is violated, it is judged as a protocol implementation defect or attack behavior, and a corresponding risk score is output, where the risk score corresponds to high risk, medium risk, and low risk. The defense strategy is dynamically adjusted based on the risk score: if it is high risk, the PMK is refreshed or high-risk frequency bands are disabled first through the hardware key management module; if it is medium risk, the device protocol compatibility is verified through firmware-level capability negotiation; if it is low risk, abnormal events and defense action logs are recorded only through the hardware logger.

2. The method for detecting wireless network security according to claim 1, characterized in that, The cross-band protocol conformance verification module also includes: By comparing the hardware protocol version fields of radio products in different frequency bands, if at least two frequency bands are found to have inconsistent protocol versions, it is marked as a protocol version conflict event. Frequency band isolation strategy based on protocol version conflict events: Add frequency bands with protocol version conflicts to the hardware blacklist to prevent devices from initiating new handshakes on frequency bands with protocol version conflicts; Send hardware-level WPA3-SAE capability negotiation request to the target device. If the device fails to respond, trigger a deauthentication frame and record the protocol downgrade risk.

3. The method for detecting wireless network security according to claim 1, characterized in that, The frequency band isolation strategy also includes: Write the MAC address and frequency band identifier of the conflicting frequency band into the hardware blacklist storage unit of the radio product; When a device is detected to initiate a new SAE handshake request in a blacklisted frequency band, the hardware module automatically discards the new SAE handshake request and records the interception log. If the device is subsequently detected to have successfully completed the WPA3-SAE handshake in the blacklisted frequency band, the blacklist identifier of the conflicting frequency band will be automatically removed.

4. The method for detecting wireless network security according to claim 1, characterized in that, The method also includes: Based on the logs of frequency band isolation actions and protocol version conflict events captured by hardware, timestamp correlation analysis is used to identify whether attackers are carrying out coordinated attacks across multiple frequency bands. Coordinated attacks include attackers inducing devices to downgrade and switch to the 2.4GHz frequency band via the 6GHz band. Based on the correlation analysis results, hardware isolation strategies are dynamically optimized, including strengthening monitoring of specific frequency bands or expanding the isolation range.

5. The method for detecting wireless network security according to claim 1, characterized in that, The method also includes a defect detection step based on protocol parsing: The hardware parsing module of the radio product performs field-level parsing on the SAE handshake frame sent by the target device, extracting the hardware random number in the Commit message, the hash value of the Confirm message, and the PMK generation parameters. If a missing hardware random number or a duplicate hardware random number is detected in the Commit message, it is determined to be a protocol implementation defect; if the hash value of the Confirm message is inconsistent with the parameters of the Commit phase, it is determined to be a hardware protocol implementation defect. Based on the hardware protocol, a pre-set risk scoring library for defect matching is implemented, and the corresponding risk level is output.

6. The method for detecting wireless network security according to claim 1, characterized in that, The dynamic threshold adjustment also includes: Baseline thresholds are calculated based on the historical number of handshake failures in each frequency band of the radio product hardware. When the number of handshake failures of a device in a specific frequency band exceeds the baseline threshold of a preset window time consecutively, the hardware logic automatically adjusts the upper limit of the dynamic threshold for that specific frequency band. If the alarm continues to be triggered after the dynamic threshold is adjusted, it will be marked as an abnormal mode and pushed to the security management platform. At the same time, an authentication frame will be sent to the target device through the hardware interface and an abnormal log will be recorded.

7. The method for detecting wireless network security according to claim 1, characterized in that, The method also includes: The strategy selection is driven by the corresponding risk score: if the risk score is high, the hardware module immediately triggers a deauthentication frame and blocks the current frequency band connection, while forcibly refreshing the hardware key; if the risk score is medium, a WPA3-SAE capability negotiation request is sent to the target device and an observation log is recorded; if the risk score is low, only logs are recorded and continuous monitoring is performed. If a device is detected to have triggered a high-risk event in the 6GHz band, the handshake verification frequency will be increased simultaneously in the 2.4GHz and 5GHz bands.

8. A device for detecting wireless network security, characterized in that, include: The four-way interaction data extraction module captures wireless communication traffic in the 2.4GHz, 5GHz and 6GHz frequency bands in real time through the hardware module of the radio product, performs protocol parsing on the wireless communication traffic, and extracts the four-way interaction data of the device executing the WPA3SAE handshake protocol in each frequency band. The four-way interaction data includes Commit message, Confirm message, PMK generation parameters and hash verification value. The consistency verification module compares the SAE handshake process of each frequency band to verify the consistency of the hardware generation logic. In the process of verifying the consistency of the hardware generation logic, it includes determining whether the hardware random number is unique and whether the Confirm hash value matches; counting the number of handshake failures in each frequency band. If the number of handshake failures in any frequency band exceeds a preset dynamic threshold, it is judged as a potential attack behavior; detecting whether abnormal frames of WPA2 authentication mode appear in the 6GHz frequency band. If detected, an alarm is triggered. The anomaly detection module is used to automatically send an authentication frame to the wireless product's hardware module when an abnormal number of handshake failures is detected, forcibly disconnecting the target device and triggering a re-handshake process; if an abnormal frame of WPA2 compatible mode is detected in the 6GHz band, the wireless communication function of the 6GHz band is immediately disabled through hardware interface configuration. The risk scoring output module defines hard rules based on the SAE handshake protocol specifications supported by the radio product hardware, including: the Commit message must contain a unique, non-repeatable hardware-generated random number; the hash value of the Confirm message must be consistent with the hardware parameters in the Commit phase; and PMK generation must be based on a hardware-level dynamic key exchange algorithm. If any rule is violated, it is determined to be a protocol implementation defect or attack behavior, and the corresponding risk score is output, where the risk score corresponds to high risk, medium risk, and low risk. The defense strategy adjustment module dynamically adjusts the defense strategy based on the risk score: if it is high risk, it will prioritize refreshing the PMK or disabling high-risk frequency bands through the hardware key management module; if it is medium risk, it will verify the device protocol compatibility through firmware-level capability negotiation; if it is low risk, it will only record abnormal events and defense action logs through the hardware logger.

9. A device for detecting wireless network security, characterized in that, Includes a processor, wherein the processor runs a program for detecting wireless network security as described in any one of claims 1-7.

10. A storage medium, characterized in that, The program stores a method for detecting wireless network security as described in any one of claims 1-7.

Images