A wireless signal privacy detection method and system based on spectrum analysis

Abstract

The application discloses a wireless signal secret detection method and system based on spectrum analysis, realizes detection of illegal wireless signals from a pseudo base station under the premise of protecting the privacy of users, and effectively realizes detection even in a scene where different operators cannot coordinate. In addition, the method provided by the application determines which user identifier information has been leaked, that is, a risk terminal, on the basis of the identifier information of the user terminal, the risk terminal is the focus of subsequent attack behaviors of the pseudo base station, and then the detection result of different operators and the performance of the risk terminal are combined to detect the risk wireless signal, so that the detection accuracy is improved. Moreover, the detection process is cooperated by the detection end and the operation end, and the risk monitoring is realized together, which is beneficial to reducing errors. Then, an alarm is sent to the corresponding user based on the monitoring result, so that the harmfulness of the risk result is reduced as much as possible.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing for management, supervision or prediction purposes, and in particular to a wireless signal security detection method and system based on spectrum analysis. BACKGROUND

[0002] A wireless signal refers to an electrical signal that is transmitted through radio waves or other electromagnetic waves. It refers to information transmitted in wireless communication, which can be sound, images, data and various forms of information. Wireless signals can be used in various wireless communication systems such as broadcasting, mobile communication, satellite communication and wireless LAN.

[0003] With the development of wireless communication technology and the popularity of wireless communication terminals, wireless signals have become an indispensable communication medium in production and life. Wireless signals provide convenience for people, but also can become a means for illegal behavior by criminals.

[0004] For example, a pseudo base station based on a wireless signal. The "pseudo base station" is also known as a "fake base station" or "fake base station". It is an illegal radio communication device that takes advantage of the defects of GSM one-way authentication, mainly composed of a host and a notebook computer, which can search for GSM mobile phone information within a certain radius centered on it, and arbitrarily use other people's mobile phone numbers to send spam messages such as fraud and sales to user mobile phones. It is usually placed in a car or a relatively hidden place to send. When the pseudo base station is running, the user's mobile phone signal is forced to connect to the device, and cannot be connected to the public telecommunications network. Lightly, it affects the normal use of mobile phone users, and heavily, it causes loss to mobile phone users.

[0005] In order to protect mobile phone users, operators will also carry out some detection work on pseudo base stations, but due to poor communication channels between operators and anti-reconnaissance means of pseudo base stations, detection of pseudo base stations inevitably has deficiencies.

[0006] How to detect risky wireless signals while protecting user privacy has become a problem to be solved. SUMMARY

[0007] The embodiments of the present application provide a wireless signal security detection method and system based on spectrum analysis to at least partially solve the above technical problems.

[0008] The embodiments of the present application adopt the following technical solutions:

[0009] In a first aspect, the embodiments of the present application provide a wireless signal security detection method based on spectrum analysis, which comprises:

[0010] The detection end receives the identification information of the suspected terminal and the information of the abnormal event of the suspected terminal which are obtained by performing Hash algorithm on the original information sent by each operation end;

[0011] For each suspected terminal, a space-time information graph is constructed based on the information of the abnormal event thereof; the nodes in the space-time information graph are used to represent the time, geographical position and type of the abnormal event;

[0012] The space-time information graphs of different suspected terminals are matched, and the nodes in which can be matched to the nodes with a similarity greater than a preset similarity threshold are taken as target nodes;

[0013] The detection end receives the identification information of the suspected terminal and the information of the abnormal event of the suspected terminal which are obtained by performing Hash algorithm on the original information sent by each operation end;

[0014] The identification information of the risk wireless signal and the identification information of the risk terminal are returned to the operation end, so that the operation end determines the risk wireless signal as a target wireless signal when it is determined that there is a risk terminal in the suspected terminal which matches the position information of the risk wireless signal; the suspected terminal in the range of the target wireless signal is taken as a first terminal, and alarm information is further sent to the first terminal; the risk terminal is the suspected terminal corresponding to the space-time information graph to which the target node belongs; the similarity threshold is negatively correlated with the maximum number of times in history when the terminal is determined as a first terminal.

[0015] In an optional embodiment of the present specification, the method further comprises:

[0016] After determining the risk terminal, the detection end returns the identification information of the risk terminal to the operation end, so that the operation end sends a geographical position tracking permission to the risk terminal to obtain the right to acquire the geographical position of the risk terminal.

[0017] In an optional embodiment of the present specification, the method further comprises:

[0018] A second terminal is determined from the risk terminal; the second terminal is a risk terminal which is determined as a first terminal more than a preset first number threshold in history;

[0019] The space-time information graph of the suspected terminal which first appears in the received suspected terminal update information sent by the operation end is matched with the space-time information graph of the second terminal.

[0020] In an optional embodiment of the present specification, the method further comprises:

[0021] The identification information of the suspected terminal includes: IMSI, and / or mobile phone number.

[0022] In an optional embodiment of the present specification, the method further comprises:

[0023] The abnormal event includes: abnormal location update, and / or registration rejection.

[0024] In an optional embodiment of the present specification, the method further comprises:

[0025] The feature information of the suspected wireless signal includes: illegal base station identification, and / or abnormal cell reselection parameter.

[0026] In an optional embodiment of the present specification, the method further comprises:

[0027] The matching degree threshold is negatively correlated with the maximum number of times in history determined as a risk wireless signal.

[0028] In an optional embodiment of the present specification, the method further comprises:

[0029] Based on the data returned by the operation end, update the spatio-temporal information atlas;

[0030] After each update, if the geographic location information contained in the information of the corresponding abnormal event appears more than a preset second number threshold within a specified historical time period from the current time, the suspected terminal is not unique, and the geographic location information is determined as target information;

[0031] Return the target information to the operation end, so that the operation end adjusts the cell reselection parameter of the cell corresponding to the target information.

[0032] In an optional embodiment of the present specification, the method further comprises:

[0033] The cell reselection parameter includes: cell reselection bias parameter, and / or cell reselection hysteresis parameter.

[0034] In a second aspect, the embodiments of the present application also provide a wireless signal security detection system based on spectrum analysis, the system comprising a detection end:

[0035] The detection end is configured to receive the identification information of the suspected terminal and the information of the abnormal event of the suspected terminal obtained by performing Hash algorithm processing on the original information sent by each operation end;

[0036] For each of the suspected terminal, based on the information of its abnormal event, a space-time information graph is constructed for it; the node in the space-time information graph is used to represent the time, geographical location and type of the event;

[0037] The space-time information graphs of different suspected terminals are matched, and the node that can be matched to the similar degree greater than the preset similarity threshold is taken as a target node;

[0038] Real-time receiving of the feature information and location information of each suspected wireless signal determined based on spectrum analysis sent by each operation terminal, and determining the risk wireless signal when the matching degree is greater than the preset matching threshold;

[0039] The identification information of the risk wireless signal and the identification information of the risk terminal are returned to the operation terminal, so that when the operation terminal determines that there is a risk terminal in the suspected terminal that matches the location information of the risk wireless signal, the risk wireless signal is determined as a target wireless signal; the suspected terminal in the range of the target wireless signal is taken as a first terminal, and then the first terminal is sent an alarm information; the risk terminal is the suspected terminal corresponding to the space-time information graph to which the target node belongs; the similarity threshold is negatively correlated with the maximum number of times in history determined as the first terminal.

[0040] In a third aspect, the embodiments of the present application further provide an electronic device, comprising:

[0041] a processor; and

[0042] a memory arranged to store computer executable instructions that, when executed, cause the processor to perform the method steps of the first aspect.

[0043] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores one or more programs, and the one or more programs, when executed by an electronic device comprising a plurality of application programs, cause the electronic device to perform the method steps of the first aspect.

[0044] The above at least one technical solution adopted by the embodiments of the present application can achieve the following beneficial effects:

[0045] The method provided by the application is executed by a detection terminal, realizes detection of illegal wireless signals from a pseudo base station under the premise of protecting the privacy of a user, and can effectively realize detection even in a scenario where different operators cannot coordinate. In addition, the method provided by the application determines, on the basis of identification information of a user terminal, which identification information of the user has been leaked, that is, a risk terminal, and then can detect the risk wireless signals by combining the detection results of different operators and the performance of the risk terminal, so as to improve the accuracy of detection. Moreover, the detection is cooperated by the detection terminal and the operation terminal, and the risk monitoring is realized together, which is beneficial to reducing errors. Then, an alarm is sent to the corresponding user on the basis of the monitoring result, so as to reduce the harmfulness of the risk result as much as possible. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 A process schematic diagram of a wireless signal security detection method based on spectrum analysis provided by an embodiment of the present specification;

[0047] Figure 2 A structural schematic diagram of an electronic device in the embodiment of the present specification. DETAILED DESCRIPTION

[0048] The application will be described in further detail below with reference to the drawings. In different embodiments, similar elements are denoted by similar reference numerals. In the following embodiments, many details are described in order to make the application better understood. However, a person skilled in the art can easily recognize that some features can be omitted in different cases, or can be replaced by other elements, materials or methods. In some cases, some operations related to the application are not shown or described in the specification, in order to avoid the core part of the application being overwhelmed by too much description, and it is not necessary to describe these related operations in detail for a person skilled in the art according to the description in the specification and general technical knowledge in the art.

[0049] In addition, the features, operations or characteristics described in the specification can be combined in any appropriate way to form various embodiments. Meanwhile, the steps or actions in the method description can also be sequentially changed or adjusted in a manner that is obvious to a person skilled in the art. Therefore, the order in the specification and the drawings is only for clear description of a certain embodiment, and does not mean a necessary order, unless otherwise stated that a certain order must be followed.

[0050] The serial numbers of components in this paper, such as "first", "second", etc., are only used to distinguish the described objects, and have no technical meaning. The "connection" and "coupling" in this application include direct and indirect connections (couplings) unless otherwise specified.

[0051] The technical solutions provided by the embodiments of the present application are described in detail below in combination with the drawings.

[0052] As shown in Figure 1 The wireless signal privacy detection method based on spectrum analysis in this specification includes the following steps:

[0053] S100: The detection end receives the identification information of the suspected terminal obtained by performing Hash algorithm processing on the original information sent by each operation end, and the information of the abnormal event of the suspected terminal.

[0054] The technical solutions in this specification aim to "locate" the risk wireless signal more accurately based on the "two-way screening" between the user terminal (the suspected terminal is a kind of user terminal) and the wireless signal. The process is carried out by the detection end and the operation end to jointly undertake the detection function. In this specification, if not otherwise specified, the method steps in this specification are described from the perspective of the detection end as the main body of execution.

[0055] The method in this specification is based on a wireless signal privacy detection system based on spectrum analysis, which includes a communication-connected detection end and an operation end, and the operation end can not be unique. The detection end can be a distributed server. The operation end can provide communication services for the user's terminal, that is, the device performance of the operator.

[0056] The original information is the original information of the suspected terminal for identification, which can be IMSI (International Mobile Subscriber Identity) or mobile phone number. International Mobile Subscriber Identity (IMSI) is an identification code used to distinguish different users in a cellular network, which is not repeated in all cellular networks. The mobile phone stores the IMSI in a 64-bit field and sends it to the network. IMSI can be used to query the user's information in the home location register (HLR) or visitor location register (VLR).

[0057] Generally, the original information is the privacy information of the user and cannot be disclosed, but there are some situations where the user's privacy information is disclosed, and the illegal user will initiate an attack on the user based on the privacy information. For example, a pseudo base station transmits illegal wireless signals in a cell a, and its coverage should be the entire cell a, but only Zhang San received a fraudulent short message, because in the cell a, only Zhang San's original information was disclosed, causing risk, and the original information of others was not disclosed, so they will face this risk to a lesser extent. Moreover, Zhang San's original information has been disclosed, indicating that the disclosure risk of different illegal users can be considered the same, even if it is the same illegal user, the use of privacy information is not one-time, that is, the abnormal event will not occur only once, which provides a condition for tracking illegal wireless information.

[0058] As an operating end, it is also not authorized to disclose the original information of the user to other parties, so the method in the specification processes the user's information through a Hash algorithm when it needs to be transmitted. As a result, the detection end cannot obtain the original information, but the identification information with the ciphertext feature can also be used in the subsequent detection step.

[0059] A Hash algorithm is a mathematical function that converts input data of arbitrary length into a fixed-length output (hash value or digest). When discussing the natural laws of hash algorithms, we usually refer to some basic principles and natural processes that they rely on in their design. A hash algorithm is a function that converts input of arbitrary length (also known as plaintext) into a fixed-length output through a hash function, which is usually called a hash value or digest. Although the design of hash algorithms is not based solely on natural laws, they do draw on certain natural phenomena and basic principles, including determinism, one-wayness, collision resistance, and avalanche effect. Determinism: the same input always produces the same hash value, ensuring consistent verification of data. One-wayness: it is impossible to deduce the original input from the hash value, ensuring data confidentiality. Collision resistance: it is extremely difficult to find two different inputs that produce the same hash value, and the longer the output length, the more difficult it is to collide. Avalanche effect: a small change in input will result in a significant difference in hash value, enhancing the reliability of data integrity verification.

[0060] And in the local of the operator, there can be mapping relationship data between the original information and the identification information of the user terminal, so as to facilitate subsequent searching.

[0061] The information of abnormal events of the suspected terminal in the specification includes but is not limited to abnormal location update and registration rejection. Abnormal location update (TAU / LAC update): the pseudo base station usually sets a tracking area code (TAC) or a location area code (LAC) different from the existing network, and induces the terminal to frequently initiate location update. The operator can find a large number of abnormal location update requests in a short time through the signaling monitoring system (such as XDR data). Registration rejection (REGISTRATION REJECT): the pseudo base station may frequently issue registration rejection messages, and the operator can identify such abnormalities through NAS signaling analysis. For details in the art, other technical means that can be used to detect abnormal events are applicable to the specification under the condition that the conditions are allowed. In order to realize the subsequent steps, in addition to recording the information of the abnormal event itself, the operator also records the event and the geographical position (for example, it can be the location of the cell) where the abnormal event occurs, to provide conditions for the construction of the subsequent atlas.

[0062] The detection of the geographical position of the user terminal by the operator at this time is based on the detection of abnormal events for the purpose of network optimization (such as MDT data has been de-identified), and is not a detection for the personal whereabouts of the user, and there is no subjective intention to infringe personal privacy. That is, this determination of the geographical position is in the positioning in the normal standby or call scenario, and the operator has the right to obtain the cell level (hundred meters-kilometer level), which is the default network requirement and does not require the authorization of the user.

[0063] In an optional embodiment of the specification, the operator can realize cell ID (Cell ID) positioning based on the cellular network. The principle is that the mobile phone is always in communication with the nearest base station, and the operator can know the cell ID (including LAC / TAC / CI, etc.) currently connected by the user. The accuracy is: city: 100 meters-2 kilometers (depending on the base station density). Rural: several kilometers. Real-time update (recorded each time the cell is switched). The operator can also realize enhanced cell ID (E-CID) based on the cellular network. The principle is to estimate the distance between the user and the base station by combining the signal strength (RSSI / RSRP) and the time advance (TA). The accuracy is: 50-500 meters (supported by the base station).

[0064] Since an attack behavior initiated by a certain pseudo base station may not only be directed at a user terminal served by a certain operator, but also at different user terminals served by different operators, and the operator cannot implement cross-network detection, the detection terminal in this step receives the data sent by each operation terminal, and can realize cross-network and cross-operator information integration, and at the same time, privacy leakage does not occur.

[0065] The suspected terminal in the specification is a user terminal that may have a privacy disclosure risk determined by the operation end based on its own detection means. In related technologies, technical means that enable the operator to implement such detection are applicable to the present specification under the condition that the conditions permit. Thus, the primary screening of user terminals by the operation end helps to save the detection end's computing power in subsequent steps to improve efficiency.

[0066] S102: For each of the suspected terminals, based on the information of the abnormal events, a spatiotemporal information graph is constructed for it.

[0067] The spatiotemporal information graph in this step corresponds to the suspected terminal one by one, and the spatiotemporal information graph has scalability, which can be expanded according to subsequent data. The spatiotemporal information graph contains a plurality of nodes, and the nodes in the spatiotemporal information graph are used to represent the time, geographical location and type of the event (type, for example, refusal to register, abnormal location change) that occurs. As for the arrangement of the nodes, the present specification does not make specific requirements, for example, it can be arranged in time sequence, or it can be arranged according to the distribution of geographical location.

[0068] The spatiotemporal information graph constructed for the suspected terminal is stored locally at the detection end and identified by the identification information of the suspected terminal.

[0069] S104: The spatiotemporal information graphs of different suspected terminals are matched, and the nodes that can be matched to each other with a similarity greater than a preset similarity threshold are taken as target nodes.

[0070] The matching in this step is mainly for the matching between nodes from different spatiotemporal information graphs. In related technologies, technical means that can determine the matching degree between nodes based on the information of the nodes are applicable to the present specification under the condition that the conditions permit. If node a in spatiotemporal information graph a is matched with node b in spatiotemporal information graph b, it indicates that both of them have been interfered by the same pseudo base station in a similar time period or in a similar geographical location. Since the object successfully interfered by the pseudo base station is not unique, it indicates that the pseudo base station indeed exists, and it also indicates that the two spatiotemporal information graphs each corresponding to a suspected terminal indeed have a privacy disclosure, and compared with other user terminals, the latter still has a risk of being attacked. Thus, further screening of suspected terminals based on wireless signals is realized, and user terminals with higher risks are determined. This process is performed by the detection end, which is conducive to the integration of information from different operators and protects the privacy of users.

[0071] In an optional embodiment of the present specification, the similarity threshold value can be a preset empirical value. It is determined based on expert experience. In another optional embodiment of the present specification, the similarity threshold value is negatively correlated with the maximum number of times it has been determined as the first terminal in history. The first terminal is a user terminal with a higher risk of being attacked. The step of determining whether a user terminal is a first terminal is performed by the operation end (since the interaction between the operation and the user terminal is more timely, the discovery of abnormalities is also more timely, and the identification of the first terminal is also more timely. Moreover, the judgment of the first terminal also includes geographic location information. This step is performed by the operation end, which can further reduce the leakage of geographic location information to the detection end). After determining the first terminal each time, the operation end sends the identification information (also processed by Hash operation) to the detection end once, so that the detection end can count the similarity threshold values of different suspected terminals based on the number of accumulations, that is, the similarity threshold value is determined by the detection end based on the data sent by the operation end, and in the coordination of both. In subsequent judgments based on the similarity threshold value, the suspected terminal with the maximum number of times determined as the first terminal in history is used as the reference. Since the judgment based on the similarity threshold value is a pairwise comparison, there may be a phenomenon that the similarity threshold values used in at least two comparisons are different. In this way, the performance of the user terminal attacked by the pseudo base station in history can play a greater role in the detection process, thereby improving the accuracy.

[0072] S106: Real-time receive the characteristic information of each suspected wireless signal determined by the operation end based on spectrum analysis and the location information. The suspected wireless signal with a matching degree greater than a preset matching degree threshold value is determined as a risk wireless signal.

[0073] The risk wireless signal is a wireless signal transmitted by a pseudo base station with a higher probability, and the probability of attack on the user's terminal is higher. It needs to be further screened. In this step, the detection end only receives the information of the suspected wireless signal transmitted by the pseudo base station sent by the operation end, rather than receiving the location information of the user terminal in real time. On the one hand, the number of pseudo base stations is smaller than the number of user terminals, which is conducive to saving the data processing resources of the detection end; on the other hand, it is also conducive to the protection of the privacy of the user.

[0074] In the related art, the technical means that can enable the operation end to monitor the suspected wireless signal of the pseudo base station based on spectrum analysis is applicable to the present specification under the condition that it is allowed.

[0075] In an optional embodiment of the present specification, the operation end can detect the suspected wireless signal through the following detection dimensions of spectrum analysis:

[0076] 1. Abnormal frequency point and bandwidth: illegal frequency band occupation. Pseudo base stations may use unlicensed frequency bands (such as privately occupying unassigned frequency points of GSM 900MHz or LTE 1800MHz), and operators monitor frequency band occupation in real time through spectrum scanners or SDR devices. Detection tools: frequency sweeper (such as R&S TSMA), software-defined radio (USRP+HackRF); non-standard bandwidth configuration. The signal bandwidth of the pseudo base station may not comply with the standard (such as an LTE pseudo base station using a non-standard 1.4MHz bandwidth instead of 20MHz).

[0077] 2. Abnormal signal strength (RSRP / RSSI): ultra-high power transmission. Pseudo base stations often attract terminal access by increasing transmission power (such as LTE signal strength reaching -50dBm, far exceeding -80dBm of surrounding legal base stations). Detection method: find abnormal high signal area through MDT (minimization of drive test) data or RSRP value reported by user equipment. Fixed spectrum sensor network monitors power mutation, etc.

[0078] 3. Modulation quality defect: EVM (error vector magnitude) exceeds standard. Pseudo base stations have poor modulation quality due to poor hardware (such as LTE EVM>8%, while legal base stations<3%), which can be detected by a vector signal analyzer (such as Keysight VSA); abnormal phase noise. The local oscillator phase noise spectrum of the pseudo base station may have additional harmonics (such as noise lifting at 1kHz offset).

[0079] 4. Abnormal timing characteristics: frame timing jitter. Pseudo base stations lack high-precision clock synchronization (such as no GPS / Beidou timing), resulting in subframe start time jitter (more than ±5μs, legal base stations within ±1μs); non-standard signal period: pseudo base stations may periodically broadcast system information (such as every 30 seconds), while legal base stations continuously transmit.

[0080] In addition, in other optional embodiments of the present specification, detection can also be based on spectrum analysis combined with protocol decoding, or dynamic spectrum fingerprint library comparison, which will not be repeated here.

[0081] In an optional embodiment of the present specification, the matching degree threshold is an experience value based on expert experience. In another optional embodiment of the present specification, the matching degree threshold is negatively correlated with the maximum number of times historically determined as a risk wireless signal. Similar to the determination process of the similarity threshold described above, in this embodiment, the process of determining the matching degree threshold is also realized based on the interaction between the detection end and the operation end, which will not be repeated here.

[0082] In further optional embodiments of the present disclosure, the matching degree threshold is negatively correlated with the number of times the suspicious wireless signal has been historically determined to be a risky wireless signal. If it is a first detection, a fixed preset matching degree threshold is used, which is usually larger than the matching degree threshold determined based on the number of times, to reduce noise.

[0083] The characteristic information and the location information of the suspicious wireless signal are detected by the operation end. The characteristic information of the suspicious wireless signal has the attribute of identifying the wireless signal, and in an optional embodiment of the present disclosure, the characteristic information of the suspicious wireless signal can include but is not limited to: wireless parameters (physical layer), such as signal strength (RSRP / RSSI), carrier frequency offset (CFO), modulation quality (EVM), bandwidth; protocol parameters (signaling layer), such as system information (SIB), cell selection parameters, registration rejection rate; spatiotemporal behavior characteristics, such as location fixity, working time, user influence range. The parameters for identifying the suspicious wireless signal can include: hardware fingerprints (unforgeable characteristics), such as carrier frequency offset (CFO), phase noise spectrum, signal burst period; protocol fingerprints, such as PCI+frequency point combination, TAC / LAC conflict, signaling sequence vulnerability; spatiotemporal fingerprints, such as moving track, active time period.

[0084] In addition, some characteristic information can also serve as the identification of the wireless signal, and can be used as the identification information of the wireless signal. For example, the characteristic information of the suspicious wireless signal includes at least one of the following: illegal base station identification (PCL / CID / LAC), abnormal cell reselection parameters (such as cell reselection parameter C2, cell reselection bias CR0).

[0085] S108: Return the identification information of the risky wireless signal and the identification information of the risky terminal to the operation end.

[0086] In this step, the detection end sends the identification information of the risky wireless signal and the identification information of the risky terminal to the operation end, but in actual application scenarios, the two pieces of information are not necessarily sent at the same time, and the timing of sending can be adjusted according to business needs. For example, the identification information of the risky terminal can be returned to the operation end that provides the communication service immediately after the risky terminal is determined (not sent to every operation end, that is, the identification information is returned to the operation end that provides the communication service). The identification information of the risky wireless signal is also returned to the operation end after the riskiness of the risky wireless signal is detected, and is returned to every operation end.

[0087] After receiving the information sent by the detection end, the operation end determines that the suspected terminal exists in the position information matching the risk wireless signal (the attack behavior of the risk wireless signal covers the suspected terminal, and the risk really exists. At this time, it is a match for real-time data, that is, real-time position), determines that the risk terminal exists (which indicates that the attack behavior is likely to cause negative consequences), and determines the risk wireless signal as a target wireless signal; the suspected terminal in the range of the target wireless signal is regarded as a first terminal, and alarm information is sent to the first terminal to make the suspected user end avoid risks; the risk terminal is the suspected terminal corresponding to the spatio-temporal information graph to which the target node belongs.

[0088] In the operation of "position matching" in this step, the operation end needs to know the geographical position of the user. In an optional embodiment of the present application, the operation end can obtain the geographical position of the user at the cell level based on the default protocol. Alternatively, the operation end sends a geographical position tracking permission to the risk terminal to obtain the permission to obtain the geographical position of the risk terminal, so as to obtain a more accurate geographical position of the user to lock the pseudo base station. That is, the strategies for suspected terminals and risk terminals are different. The risk terminal is more likely to be attacked, and the attack behavior can more accurately locate the pseudo base station.

[0089] The method provided in the present application is executed by the detection end, which realizes the detection of illegal wireless signals from the pseudo base station under the premise of protecting the privacy of the user. Even in the scene where different operators cannot coordinate, the detection can be effectively realized. In addition, the method provided in the present application determines which user identification information has been leaked based on the identification information of the user terminal, that is, the risk terminal, and the risk terminal is the focus of the subsequent attack behavior of the pseudo base station. Therefore, the risk wireless signal can be detected by combining the detection results of different operators and the performance of the risk terminal, so as to improve the accuracy of the detection. Moreover, the detection process is cooperated by the detection end and the operation end to realize the risk monitoring, which is beneficial to reduce the error. Then, the alarm is sent to the corresponding user based on the monitoring result, so as to reduce the harmfulness of the risk result as much as possible.

[0090] In an optional embodiment of the present specification, in order to improve the efficiency of detection and improve the accuracy of detection, the detection end determines a second terminal from the risk terminal; the second terminal is a risk terminal that has been determined as a first terminal more than a preset first number threshold in history (the operating end can send a corresponding message to the detection end after determining a suspected terminal as a first terminal each time, so that the detection end can count the accumulation. The first number threshold can be an empirical value). The first appearance of the suspected terminal update information sent by the operating end (the operating end can update the suspected terminal list according to its own management logic and synchronize to the detection end) is matched with the spatio-temporal information graph of the second terminal. Since the second terminal is historically determined to have a high probability of being attacked, this matching is beneficial to improve efficiency and improve accuracy.

[0091] Thereafter, the operating end will also continuously detect the base station and the user terminal. The detection end updates the spatio-temporal information graph based on the data returned by the operating end; after each update, if the geographic location information contained in the information of the corresponding abnormal event appears more than a preset second number threshold (which can be an empirical value) within a specified historical time period (the length can be an empirical value, since the attack of the fixed pseudo base station is more targeted, it can be negatively related to the number of abnormal events in the updated cell to identify whether there is a pseudo base station attack) within a specified historical time period (the length can be an empirical value, since the attack of the fixed pseudo base station is more targeted, it can be negatively related to the number of abnormal events in the updated cell to identify whether there is a pseudo base station attack) The geographic location information is determined as target information (indicating that there is a high possibility of a fixed pseudo base station in the cell); the target information is returned to the operating end, so that the operating end adjusts the cell reselection parameters (such as cell reselection bias parameter CRO and cell reselection hysteresis parameter (CRH)) of the cell corresponding to the target information.

[0092] Further, the present specification also provides a wireless signal security detection system based on spectrum analysis, the system comprising a detection end:

[0093] The detection end is configured to receive the identification information of the suspected terminal obtained by performing a Hash algorithm on the original information sent by each operating end, and the information of the abnormal event of the suspected terminal;

[0094] For each suspected terminal, a spatio-temporal information graph is constructed based on the information of its abnormal event; the nodes in the spatio-temporal information graph are used to represent the time, geographic location and type of the event;

[0095] The spatio-temporal information graphs of different suspected terminals are matched, and the nodes that can be matched to have a similarity greater than a preset similarity threshold are taken as target nodes;

[0096] Real-time receiving each operation end sent based on the spectrum analysis of each suspected wireless signal characteristics information and location information, will be able to determine the matching degree greater than the matching threshold, determine the risk of wireless signal;

[0097] The identification information of the risk wireless signal and the identification information of the risk terminal are returned to the operation end, so that the operation end determines that there is a risk terminal in the suspected terminal which matches the location information of the risk wireless signal, and determines that the risk wireless signal is the target wireless signal when the risk terminal is determined; the suspected terminal in the range of the target wireless signal is regarded as the first terminal, and the alarm information is sent to the first terminal; the risk terminal is the suspected terminal corresponding to the space-time information graph to which the target node belongs; the similarity threshold is negatively correlated with the maximum number of times in history which is determined as the first terminal.

[0098] The system can perform the method in any of the preceding embodiments and can obtain the same or similar technical effects, which will not be repeated here.

[0099] Figure 2 is a structural schematic diagram of an electronic device according to an embodiment of the present application. Please refer to Figure 2 At the hardware level, the electronic device includes a processor, and optionally further includes an internal bus, a network interface, and a memory. The memory can include a memory such as a random-access memory (RAM), and can also include a non-volatile memory such as at least one disk memory. Of course, the electronic device can also include other hardware required by the business.

[0100] The processor, network interface, and memory can be connected to each other through an internal bus, which can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, and a control bus. For ease of representation, Figure 2 Only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0101] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0102] The processor reads the corresponding computer program from non-volatile memory into main memory and then runs it, forming a spectrum analysis-based wireless signal security detection system at the logical level. The processor executes the program stored in memory and specifically performs any of the aforementioned spectrum analysis-based wireless signal security detection methods.

[0103] The above is as stated in this application. Figure 1 The illustrated embodiment discloses a wireless signal security detection method based on spectrum analysis, which can be applied to or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0104] The electronic device can also perform Figure 1 A wireless signal security detection method based on spectrum analysis is proposed and implemented. Figure 1 The functions of the embodiments shown are not described again in this application.

[0105] The embodiment of the present application further provides a computer readable storage medium storing one or more programs, the one or more programs comprising instructions which, when executed by an electronic device comprising a plurality of application programs, perform any of the aforementioned spectrum analysis based wireless signal privacy detection methods.

[0106] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. In addition, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0107] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and a combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 a system to perform the functions specified in the flowcharts and / or block diagrams.

[0108] These computer program instructions can also be stored in a computer-readable memory that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction system that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 a system to perform the functions specified in the flowcharts and / or block diagrams.

[0109] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus, so that a series of operation steps are performed on the computer or other programmable data processing apparatus to produce a computer-implemented process, so that the instructions executed on the computer or other programmable data processing apparatus provide a process for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 a system to perform the functions specified in the flowcharts and / or block diagrams.

[0110] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memories.

[0111] Memory can include non-persistent memory and / or volatile memory, random access memory (RAM), and / or non-volatile memory, e.g., read only memory (ROM) or flash memory, among others. Memory is an example of computer readable media.

[0112] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disks (DVDs) or other optical storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0113] It should also be noted that the terms "comprising," "including," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the identified element.

[0114] Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer readable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0115] The above merely provides an example of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application should be included in the scope of claims of the present application.

Claims

1. A method for detecting a wireless signal privacy based on spectrum analysis, characterized in that, The method comprises: detecting identification information of suspected terminals obtained by performing Hash algorithm on original information sent by each operation end, and information of abnormal events of the suspected terminals; for each suspected terminal, constructing a space-time information graph based on the information of abnormal events thereof; a node in the space-time information graph is used to represent the time, geographical position and type of the event; performing matching processing on the space-time information graphs of different suspected terminals, and taking a node that can be matched to a node with a similarity greater than a preset similarity threshold as a target node; receiving characteristic information and position information of each suspected wireless signal determined based on spectrum analysis and sent by each operation end in real time, and determining a risk wireless signal that can be determined to have a matching degree greater than a preset matching degree threshold; returning identification information of the risk wireless signal and identification information of a risk terminal to the operation end, so that the operation end determines the risk wireless signal as a target wireless signal when it is determined that the risk terminal exists in the suspected terminals that have position information matched with the risk wireless signal; the risk terminal is a suspected terminal corresponding to the space-time information graph to which the target node belongs; the similarity threshold is negatively correlated with the maximum number of times in history when the target node is determined as a first terminal.

2. The method of claim 1, wherein, The method further comprises: after determining the risk terminal, the detection end returns the identification information of the risk terminal to the operation end, so that the operation end sends a geographical position tracking permission to the risk terminal to obtain the right to obtain the geographical position of the risk terminal.

3. The method of claim 1, wherein, The method further comprises: determining a second terminal from the risk terminal; the second terminal is a risk terminal that has been determined as a first terminal more than a preset first number threshold in history; performing matching processing on the space-time information graph of a suspected terminal that first appears in the received suspected terminal update information sent by the operation end and the space-time information graph of the second terminal.

4. The method of claim 1, wherein, The method further comprises: The identification information of the suspected terminal comprises: IMSI and / or mobile phone number.

5. The method of claim 1, wherein, The method further comprises: The abnormal event comprises: abnormal position update and / or registration rejection.

6. The method of claim 1, wherein, The method further comprises: The characteristic information of the suspected wireless signal comprises: illegal base station identification and / or abnormal cell reselection parameter.

7. The method of claim 1, wherein, The method further comprises: The matching degree threshold is negatively correlated with the maximum number of times in history when the target node is determined as a risk wireless signal.

8. The method of claim 1, wherein, The method further comprises: updating the space-time information graph based on the data returned by the operation end; after each update, if it is detected that the geographical position information contained in the information of the corresponding abnormal event appears more than a preset second number threshold within a specified historical time period from the current time, the geographical position information is determined as target information; The target information is returned to the operation end, so that the operation end determines a cell reselection parameter of a cell corresponding to the target information.

9. The method of claim 8, wherein, The method further comprises: The cell reselection parameter comprises a cell reselection bias parameter and / or a cell reselection hysteresis parameter.

10. A wireless signal security detection system based on spectrum analysis, characterized in that, The system comprises a detection end: The detection end is configured to receive identification information of suspected terminals and information of abnormal events of the suspected terminals obtained by performing a Hash algorithm on original information sent by each operation end; For each suspected terminal, a spatio-temporal information graph is constructed based on the information of abnormal events thereof; a node in the spatio-temporal information graph is used to represent a time, a geographical position and a type of an abnormal event; The spatio-temporal information graphs of different suspected terminals are matched, and a node in which a similarity is greater than a preset similarity threshold value is matched to each other, is determined as a target node; Real-time receiving of characteristic information and position information of each suspected wireless signal determined based on spectrum analysis sent by each operation end, and determination of a risk wireless signal in which a matching degree is greater than a preset matching degree threshold value; The identification information of the risk wireless signal and the identification information of a risk terminal are returned to the operation end, so that the operation end determines the risk wireless signal as a target wireless signal when it is determined that the risk terminal exists in the suspected terminals and the position information of the risk wireless signal matches; the suspected terminals in a range of the target wireless signal are determined as first terminals, and alarm information is sent to the first terminals; the risk terminal is a suspected terminal corresponding to the spatio-temporal information graph to which the target node belongs; the similarity threshold value is negatively correlated with a maximum number of times in history when the suspected terminal is determined as a first terminal.

Images