A suspicious WiFi signal source detection method and system based on multi-source signal fusion

Abstract

The application discloses a suspicious WiFi signal source detection method and system based on multi-source signal fusion, wherein the method comprises the following steps: reducing the security risk that a single feature is easily counterfeited by means of a 'hardware layer + protocol layer feature fusion' strategy; on the basis of hardware grouping, introducing network behavior features for secondary clustering and performing cross-layer consistency checking by means of preliminary clustering processing based on physical features and secondary clustering and cross-layer checking based on behavior features, and finally marking suspicious signal sources; finally, suspicious signal sources are further verified and risk evaluated through deep verification and security evaluation processing, and finally an operable signal security evaluation report is generated.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of suspicious WiFi signal source detection, and particularly relates to a suspicious WiFi signal source detection method and system based on multi-source signal fusion. BACKGROUND

[0002] With the explosive growth of the number of public WiFi access points and the continuous evolution of wireless attack technology, traditional suspicious WiFi signal detection methods mostly rely on a single detection dimension (such as MAC address filtering, signal strength threshold or isolated physical fingerprint), and attackers can bypass MAC cloning attacks (i.e. fake the MAC address of a legitimate AP to evade blacklist detection) and CFO simulation technology (i.e. use software-defined radio (SDR) to simulate the carrier frequency offset characteristics of the target device) through low-cost means. Moreover, in the mainstream detection framework, physical clustering and behavior clustering run independently, ignoring the core security assumption that "the same hardware device should have consistent behavior", and attackers can construct a combination attack of "hardware cloning + behavior disguise" (such as cloning the hardware fingerprint of a router but injecting malicious packets);

[0003] At the same time, due to noise in a high-noise environment, the signal source causes distortion of the signal in the signal transmission process, or in a multipath environment, the signal is distorted due to signal fading and phase rotation, which also causes the labeling error of the signal source. Therefore, how to detect suspicious signal sources by multi-dimensional and comprehensive analysis and suppression of noise in the physical layer and network behavior layer is a problem to be solved. SUMMARY

[0004] The present application aims to provide a suspicious WiFi signal source detection method and system based on multi-source signal fusion, which solves the above technical problems pointed out in the prior art.

[0005] The present application provides a suspicious WiFi signal source detection method based on multi-source signal fusion, comprising the following operation steps:

[0006] Collecting the radio frequency physical characteristics and network behavior characteristics of the WiFi signal sources in the target area;

[0007] Grouping the radio frequency physical characteristics by a first clustering algorithm to generate a physical characteristic cluster;

[0008] Labeling suspicious signal sources by a second clustering algorithm based on network behavior characteristics, combining cross-layer consistency verification of the physical characteristic cluster;

[0009] Based on the signal source, the local baseband signature authentication and the regional security level are analyzed and processed to generate a signal security evaluation report.

[0010] Preferably, the second clustering algorithm is used to mark suspicious signal sources based on the network behavior features and the cross-layer consistency check, including the following steps:

[0011] The network behavior feature vector is calculated according to the network behavior features, and the physical feature vector is calculated according to the radio frequency physical features.

[0012] The network behavior feature vector is subjected to constraint hierarchical clustering analysis with the physical feature cluster as the grouping constraint condition, and then combined with the behavior consistency analysis screening of the physical feature vector and the network behavior feature vector to output the mapping relationship between the network behavior feature cluster and the physical feature cluster.

[0013] The feature matrix is established based on the mapping relationship between the network behavior feature cluster and the physical feature cluster.

[0014] The mean value of the network behavior feature vectors of the signal sources in the physical feature cluster is recorded as the centroid coordinates of the physical feature cluster, and then the centroid coordinates corresponding to the signal sources in multiple physical feature clusters are collected to form a centroid coordinate set of the physical feature cluster.

[0015] The joint similarity of each two signal sources is calculated by the IQ sampling data of each signal source, combined with the centroid coordinate set of the physical feature cluster and the feature matrix; and the joint similarity matrix is constructed based on the joint similarity.

[0016] The suspicious signal sources are analyzed by spectral clustering optimization processing combined with cross-layer consistency check processing based on the joint similarity matrix.

[0017] Preferably, the joint similarity of each two signal sources is calculated by the IQ sampling data of each signal source, combined with the centroid coordinate set of the physical feature cluster, including the following steps:

[0018] The 64-QAM constellation points of the OFDM symbol in the IQ sampling data of each signal source are extracted, the constellation distortion is calculated based on the 64-QAM constellation points, and the constellation compression factor is obtained according to the constellation distortion.

[0019] The constellation compression factor table is constructed based on the constellation compression factor.

[0020] The feature scaling processing is performed on the feature matrix based on the constellation compression factor table, and the adjusted feature matrix is obtained.

[0021] The physical feature similarity of each two signal sources is calculated based on the distance from the current signal source to the corresponding physical feature cluster centroid coordinates; the network behavior feature similarity is calculated based on the adjusted network behavior features in the adjusted feature matrix corresponding to each two signal sources; and the joint similarity is calculated based on the physical feature similarity and the network behavior feature similarity.

[0022] Preferably, the suspicious signal source is obtained by using spectral clustering optimization processing based on the joint similarity matrix in combination with cross-layer consistency checking processing analysis, including the following operation steps:

[0023] A three-layer feature tensor is constructed according to the physical feature matrix, the network behavior feature matrix and the physical feature cluster; and cross-layer covariance is calculated based on the three-layer feature tensor;

[0024] Tensor singular value decomposition processing is performed on the three-layer feature tensor to extract a diagonal matrix; and the main singular value is extracted from the diagonal matrix;

[0025] The suspicious signal source is output by signal source cross-layer deviation analysis based on the main singular value in combination with multi-dimensional joint determination based on projection clustering.

[0026] Preferably, the suspicious signal source is obtained by signal source cross-layer deviation analysis based on the main singular value in combination with multi-dimensional joint determination based on projection clustering, including the following operation steps:

[0027] The signal source cross-layer deviation degree is calculated according to the main singular value, the network behavior feature matrix, the physical feature matrix and the constellation distortion degree;

[0028] A Laplace matrix is constructed based on the signal source cross-layer deviation degree, the joint similarity matrix and the constellation distortion degree; and the first n eigenvectors v1, v2, v3... vn are obtained by solving the Laplace matrix;

[0029] A projection matrix is constructed based on the first n eigenvectors; a plurality of initial cluster centers z are randomly generated based on the projection matrix; and clustering is performed on each signal source based on the minimum distance from each eigenvector vn to the initial cluster center z, and the clustering is stopped when the clustering reaches the convergence condition, and a plurality of clustering clusters are output.

[0030] The suspicious signal source is output by multi-dimensional joint determination based on the signal source cross-layer deviation degree, the constellation distortion degree and the eigenvectors vn in each clustering cluster.

[0031] Preferably, the calculation of the signal source cross-layer deviation degree includes:

[0032] The deviation degree is calculated using the physical feature values in the physical feature matrix and the network behavior feature values in the network behavior feature matrix; the principal component weight is calculated using the main singular value and the sum of all singular values; and the signal source cross-layer deviation degree is calculated based on the deviation degree and the principal component weight.

[0033] Preferably, the network behavior feature vector is subjected to constraint hierarchical clustering analysis with the physical feature cluster as the grouping constraint condition, and then the mapping relationship between the network behavior feature cluster and the physical feature cluster is output by combining behavior consistency analysis screening of the physical feature vector and the network behavior feature vector, including the following operation steps:

[0034] identify the cellular hotspot signal source and extract the baseband modulation fingerprint corresponding to the cellular hotspot signal source, calculate the network behavior feature space compression factor based on the baseband modulation fingerprint;

[0035] adjust the behavior feature vector based on the space compression factor to obtain a second network behavior feature vector;

[0036] construct a joint similarity matrix based on the second network behavior feature vector and the physical feature vector; perform secondary clustering processing based on the joint similarity matrix to generate a behavior consistency clustering cluster;

[0037] filter the behavior consistency clustering cluster with a cluster stability index greater than a physical behavior consistency threshold as a mapping relationship table of the behavior feature cluster and the physical feature cluster.

[0038] Preferably, the cellular hotspot signal is identified and the baseband modulation fingerprint is extracted, and the network behavior feature space compression factor is calculated based on the baseband modulation fingerprint, including the following operation steps:

[0039] Parse the SSID and MAC address in the signal source, match the SSID and MAC address with the cellular identification library, output the cellular marker vector of each signal source, and obtain the cellular signal source;

[0040] Calculate the autocorrelation function of each cellular signal source based on the Schmid-Cox algorithm, and determine the OFDM symbol start position based on the autocorrelation function and the energy function;

[0041] Calculate the frequency offset estimation value by phase rotation of the pre-training sequence using the autocorrelation function of the OFDM symbol start position;

[0042] Compensate the cellular signal source using the frequency offset estimation value to obtain the compensated cellular signal source;

[0043] Based on the symbol segment in the compensated cellular signal source, the space compression factor is obtained by transform correction processing combined with distortion compensation processing operation.

[0044] Preferably, based on the symbol segment in the compensated cellular signal source, the space compression factor is obtained by transform correction processing combined with distortion compensation processing operation, including the following operation steps:

[0045] Perform FFT transform processing on each symbol segment in the compensated cellular signal source, and extract the transformed data subcarrier wind volume; perform phase rotation processing on each data subcarrier component by the optimal rotation angle to obtain the corrected data subcarrier component;

[0046] calculating a minimum Euclidean distance between each two corrected data subcarrier components; distributing the minimum Euclidean distance into a preset interval to obtain an Euclidean distance histogram; and calculating a data subcarrier component distortion degree based on the Euclidean distance histogram, the number of the corrected data subcarrier components and a preset data subcarrier component mean value;

[0047] performing cellular compensation on the cellular signal source according to the data subcarrier component distortion degree to obtain a spatial compression factor.

[0048] Correspondingly, the application further provides a suspicious WiFi signal source detection system based on multi-source signal fusion, which comprises a feature acquisition module, a first clustering module, a second clustering and marking module and an evaluation module.

[0049] The feature acquisition module is configured to acquire radio frequency physical features and network behavior features of WiFi signal sources in a target area.

[0050] The first clustering module is configured to group the radio frequency physical features by a first clustering algorithm to generate physical feature clusters.

[0051] The second clustering and marking module is configured to mark suspicious signal sources by performing a cross-layer consistency test on the physical feature clusters based on the network behavior features by a second clustering algorithm.

[0052] The evaluation module is configured to analyze and process the suspicious signal sources based on local baseband signature authentication and regional security levels to generate a signal security evaluation report.

[0053] Compared with the prior art, the embodiments of the application have at least the following technical advantages:

[0054] As can be seen from the above suspicious WiFi signal source detection method and system based on multi-source signal fusion provided by the application, in specific application, first, the multi-dimensional feature acquisition and processing is performed to construct a basic data layer of the signal source, the security risk that a single feature is easily counterfeited is reduced by the "hardware layer + protocol layer feature fusion" strategy, and a comprehensive "signal portrait" containing the physical layer and the protocol layer is established for each observable WiFi signal source in the target area by constructing a multi-dimensional portrait; further, the WiFi signal sources in the target area are preliminarily grouped based on the density DBSCAN according to the hardware fingerprint by the preliminary clustering processing based on the physical features, the signal sources are classified according to the physical devices, further, the suspicious signal sources are marked by introducing the network behavior features for secondary clustering and performing cross-layer consistency test based on the hardware grouping; finally, the suspicious signal sources are further verified and risk evaluated by the deep verification and security evaluation (report generation) processing, and finally, an operable signal security evaluation report is generated. BRIEF DESCRIPTION OF DRAWINGS

[0055] Figure 1 A main flowchart of a suspicious WiFi signal source detection method based on multi-source signal fusion;

[0056] Figure 2 A physical feature cluster simulation diagram in a suspicious WiFi signal source detection method based on multi-source signal fusion;

[0057] Figure 3 A flowchart simulation diagram of marking suspicious signal sources in a suspicious WiFi signal source detection method based on multi-source signal fusion;

[0058] Figure 4 A 64-QAM constellation diagram simulation diagram in a suspicious WiFi signal source detection method based on multi-source signal fusion;

[0059] Figure 5 A 64-QAM constellation diagram distortion simulation diagram in a suspicious WiFi signal source detection method based on multi-source signal fusion;

[0060] Figure 6 A whole architecture diagram of a suspicious WiFi signal source detection system based on multi-source signal fusion.

[0061] Reference signs: feature collection module 10, first clustering module 20, second clustering and marking module 30, and evaluation module 40. DETAILED DESCRIPTION

[0062] The technical solutions of the present application will be described clearly and completely below in combination with the drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0063] The present application will be described in further detail below through specific embodiments and in combination with the drawings.

[0064] Embodiment one

[0065] As shown in the drawings, the present application provides a suspicious WiFi signal source detection method based on multi-source signal fusion, which includes the following operation steps: Figure 1

[0066] Step S10: Collecting radio frequency physical features and network behavior features of WiFi signal sources in a target area;

[0067] ​The radio frequency physical features include signal strength distribution, carrier frequency offset (CFO), modulation error rate (EVM), and the like hardware fingerprints; and the network behavior features include data packet retransmission rate, connection request time delay coefficient of variation, and encrypted handshake anomaly count.

[0068] It should be noted that the embodiments of the present application establish a multi-dimensional signal portrait of the WiFi signal sources in the physical layer and the protocol layer in the target area by fusing the hardware layer and the protocol layer features, to identify and crack a single feature impersonation (such as CFO simulation attack).

[0069] Step S20: grouping the radio frequency physical features by a first clustering algorithm to generate physical feature clusters.

[0070] It should be noted that, as shown in Figure 2 The embodiments of the present application distinguish different hardware devices, and the signal in the same cluster should come from the same physical device (such as a router or a mobile phone hotspot). The embodiments of the present application perform the first clustering processing on the radio frequency physical features by the density-based DBSCAN clustering algorithm. Specifically, a feature vector is formed by the radio frequency physical features of each WiFi signal source, then a neighborhood radius is set, that is, a distance threshold of adjacent points and a minimum point threshold (including itself) required for forming a dense area of a cluster are considered. Then, clustering is started. For each point, the number of points in the neighborhood radius of the point is calculated. If the number of points in the neighborhood radius of the point is greater than or equal to the minimum point threshold, the point is marked as a core point, and a new cluster is created. Then, from the core point, all points that are density-reachable are recursively added to the cluster. The above process is repeated until all points are visited, and a plurality of physical feature clusters (each cluster contains a plurality of points, that is, a plurality of signal sources) are obtained. The WiFi signal sources in the current target area are clustered based on the radio frequency physical features, and the physical feature clusters are output. (Therefore, the physical feature clusters are data clusters clustered based on the radio frequency physical features.) In the subsequent processing, clustering processing is performed again based on the protocol layer and the logistics layer (that is, step S30), so that the physical layer and the protocol layer are closely combined, and the accuracy of the signal source analysis and security evaluation processing is improved.

[0071] Step S30: marking suspicious signal sources by performing cross-layer consistency checking on the physical feature clusters based on the network behavior features by a second clustering algorithm.

[0072] Step S40: analyzing and processing the signal sources based on the local baseband signature authentication and the regional security level to generate a signal security evaluation report.

[0073] It should be noted that the above embodiment of the present application adopts the method of hierarchical feature collection, step-by-step clustering fusion and cross-layer consistency verification, constructs the "multi-dimensional signal portrait" of the WiFi signal source from two dimensions of the hardware physical layer and the network protocol layer, and detects suspicious signal sources (such as malicious APs and phishing hotspots) by comparing whether the features of the two layers are consistent (whether they come from the same real device).

[0074] Specifically, the embodiment of the present application first constructs the basic data layer of the signal source through multi-dimensional feature collection and processing, reduces the security risk that a single feature (such as only relying on CFO) is easily counterfeited (such as "CFO simulation attack") through the "hardware layer + protocol layer feature fusion" strategy, and establishes a comprehensive "signal portrait" containing the physical layer and the protocol layer for each observable WiFi signal source (SSID / BSSID) in the target area through the construction of the multi-dimensional portrait; further, it performs preliminary grouping based on the density of DBSCAN of the WiFi signal source in the target area according to the hardware fingerprint (i.e. the radio frequency physical feature), and identifies physically different transmitting devices; first, the signal source is classified according to the physical device from the most stable and most difficult-to-counterfeit hardware layer; further, the secondary clustering based on the behavior feature and the cross-layer verification (marking suspicious), on the basis of the hardware grouping (physical feature cluster), introduce the network behavior feature for secondary clustering, and perform cross-layer consistency verification, and finally mark the suspicious signal source;

[0075] Finally, through the deep verification and security evaluation (generating a report) process, the suspicious signal source marked in step S30 is further verified and risk evaluated, and finally an operable signal security evaluation report is generated; for example, through local baseband signature authentication, the suspicious signal source is further authenticated, which may be more resource-consuming, the baseband signal features (such as the subtle signature of a specific chip set) are analyzed, the signal source is tried to be connected securely and verified for its certificate or preset legal signature, and the known malicious signature database on the local or cloud is queried for comparison; regional security level analysis, combined with the security context of the target area, for example, in high security level areas such as airports and banks, any suspicious signal should be highly valued, in public areas such as coffee shops, the evaluation may be more relaxed, or the risk is judged based on historical data, the threat level in the current network environment is considered, a signal security evaluation report is generated, the above analysis is integrated, and the report is output, that is, the list of confirmed suspicious signal sources (SSID / BSSID), the description of suspicious reasons (such as: physical counterfeiting but abnormal behavior, highly malicious behavior, cross-layer inconsistent attribution), the baseband authentication result (such as: signature mismatch, invalid certificate), the risk evaluation level based on the regional security level (such as: high risk, medium risk, low risk), and the suggested measures (such as: alarm, shielding, further monitoring).

[0076] Specifically, such as Figure 3 As shown, in step S30, the second clustering algorithm uses network behavior features to combine physical feature clusters with cross-layer consistency checks to mark suspicious signal sources, including the following steps:

[0077] Step S31: Obtain the network behavior characteristics (including packet retransmission rate, connection request delay variation coefficient, and encryption handshake anomaly count) of the data packet streams of each signal source obtained from the process in step S10; calculate the network behavior feature vector based on the network behavior characteristics; calculate the physical feature vector based on the radio frequency physical characteristics;

[0078] Step S32: Using physical feature clusters as grouping constraints, perform constrained hierarchical clustering analysis on network behavior feature vectors, and then combine the behavior consistency analysis of physical feature vectors and network behavior feature vectors to filter and output the mapping relationship between network behavior feature clusters and physical feature clusters.

[0079] Step S33: Based on the mapping relationship between network behavior feature clusters and physical feature clusters, establish a feature matrix; record the mean value of the network behavior feature vector of the signal source within the physical feature cluster (which is a cluster of multiple signal sources) as the centroid (i.e., the centroid of the cluster) coordinate of the physical feature cluster, and then gather the centroid coordinates corresponding to the signal sources within multiple physical feature clusters to form a set of centroid coordinates of the physical feature cluster.

[0080] Explanation: Physical feature clusters are obtained by clustering radio frequency physical features (such as CFO, EVM, etc.), reflecting the similarity of hardware devices (i.e., devices of the same physical device or model will be clustered together). Network behavior features (such as packet retransmission rate, connection request delay variation coefficient, encryption handshake anomaly count, etc.) reflect the device's performance at the protocol layer, which is usually related to hardware device type, device status, and network environment. The mean of the network behavior feature vectors of signal sources (i.e., devices with similar hardware) within the same physical feature cluster is taken. This mean can represent the typical network behavior of that hardware type under normal conditions. In other words, devices in the same physical cluster should have similar network behaviors. If a device is in the same physical cluster but its network behavior deviates significantly from the typical behavior (mean) of that cluster, it may indicate that the device is abnormal (e.g., controlled by an attacker or a counterfeit device). This application embodiment combines the physical layer and the network behavior layer, which is the core of cross-layer consistency verification. It uses physical layer grouping (hardware grouping) to establish a normal benchmark for the network behavior layer, and then detects the behavioral deviations of individuals within the group (i.e., within the physical layer group), thereby identifying suspicious signal sources.

[0081] In particular implementation, according to the division of the physical feature cluster, the behavior feature vector of the signal source in each physical cluster is extracted, for each physical cluster, the mean of the behavior feature vectors of all signal sources in the physical cluster is calculated to obtain the behavior centroid of the physical cluster (note that the centroid is a point in the behavior feature space); the physical layer and the network behavior layer are combined, that is, the network behavior of the devices in the same physical cluster should be close to the behavior centroid, if the network behavior feature of a device deviates significantly from the behavior centroid of the physical cluster to which the device belongs, then the device may be abnormal, in the subsequent steps (S34 and thereafter), the network behavior centroid is used to calculate the behavior deviation degree of each signal source, and then combined with other indicators (such as constellation distortion degree) to mark the suspicious signal source;

[0082] The network behavior feature is essentially a quantitative analysis of the data packet and the network behavior feature, and the above-mentioned physical feature cluster is a feature label for the adaptation type of the node (hot spot), terminal and / or router end.

[0083] For example, Table 1 below is a feature matrix established according to the mapping relationship, where the horizontal columns respectively represent five feature vector items of the signal source, the physical feature cluster, the packet retransmission rate, the connection request delay variation coefficient, and the encryption handshake anomaly count, and the vertical columns represent the corresponding numerical values of the feature vector items:

[0084] Signal source Cluster of physical characteristics Data packet retransmission rate (%) Connection request latency coefficient of variation Encrypted handshake anomaly count AP1 Cluster 1 1.2 0.15 0 AP2 Cluster 2 0.8 0.12 1 AP3 Cluster 3 15.7 0.83 5

[0085] In Table 1 above, the 15.7% retransmission rate (normal <5%) and the 0.83 delay variation coefficient (normal <0.3) of signal source 3 (AP3) indicate abnormality; steps S31-S33 are analysis and processing performed for each signal source, and subsequent step S34 continues to analyze the constellation distortion degree and the constellation compression factor (or the first compression factor) of each signal source.

[0086] Step S34: 64-QAM constellation points of the OFDM symbol (the OFDM symbol is the basic transmission unit of the 802.11 standard, composed of multiple orthogonal subcarriers) in the IQ sampling data (IQ sampling data is a complex form of signal sequence (I is the real part and Q is the imaginary part), from the ADC output of the WiFi receiver, which can be extracted from the signal source) of each signal source are extracted, the constellation distortion degree is calculated based on the 64-QAM constellation points, and the constellation compression factor is obtained according to the constellation distortion degree; the constellation compression factor table is constructed based on the constellation compression factor;

[0087] It should be noted that in the above embodiments of the present application, 64-QAM (64-order quadrature amplitude modulation) is a modulation method commonly used in digital communication systems, which combines 6-bit information (each bit represents a state) to achieve high data transmission rate. 64-QAM has 64 different constellation points, each point representing a different 6-bit binary number; the 64-QAM constellation diagram is a two-dimensional graph, as shown in Figure 4 Each point represents a specific complex value, usually on orthogonal I (in-phase) and Q (quadrature) axes. For a more intuitive understanding, the constellation points are arranged in an 8x8 grid. Specifically, the 64 constellation points are distinguished by 8 different horizontal and vertical positions, and the interval of these positions depends on the amplitude and phase of the signal. In 64-QAM, the I and Q axes are usually arranged with positive integer intervals (for example: -7, -5, -3, -1, 1, 3, 5, 7). The combination of each point is a different symbol, and the coordinates (I, Q) of each constellation point correspond to a specific bit sequence. In 64-QAM, each constellation point corresponds to a specific bit value, which is usually arranged according to the following rules:

[0088] The 6 bits can represent 64 possible combinations, each combination corresponding to a different constellation point.

[0089] Each point of the constellation diagram is distinguished by its coordinates on the I and Q axes, for example: (3, 5) may represent 011010, and (-1, -3) may represent 101101.

[0090] The above embodiments of the present application use 64-QAM, which can provide higher data rates than QPSK (each point represents 2 bits) and 16-QAM (each point represents 4 bits) because each constellation point represents 6 bits.

[0091] As shown in Figure 5 The constellation distortion describes the shift and shape deformation of the constellation points from the ideal position due to various factors such as noise, channel fading, non-linear effects, etc. In an ideal case, each constellation point in the constellation diagram should be uniformly distributed according to the specified rules (such as the I and Q axis coordinates of QAM modulation) and maintain a fixed relative position. However, in actual communication, the signal may be distorted after transmission, affecting the performance of the system. That is, during transmission, the signal may be disturbed by noise, causing the constellation points at the receiving end to shift and thus become distorted. Or in a multipath environment, the signal may experience fading and phase rotation, causing changes in the constellation point position. Or the non-linear characteristics of modems, power amplifiers, and other devices may cause the constellation points to deform, resulting in distortion of the constellation diagram. The constellation compression factor is inversely proportional to the constellation distortion. As the distortion increases, the constellation compression factor decreases.

[0092] The constellation compression factor is usually used to describe the change of a signal during some processing (such as signal compression or encoding), especially in digital signal processing, the constellation compression factor is used to quantify the compression degree of a signal or data, and the embodiment of the application calculates the constellation compression factor by the constellation distortion degree, compresses the behavior characteristic weight of a high-distortion signal (such as a malicious device), and thus avoids excessive noise interference caused by the high-distortion signal;

[0093] For example, Table 2 below is a constructed constellation compression factor table:

[0094] Signal source Constellation distortion Constellation compression factor AP1 0.05 0.95 AP3 0.41 0.71

[0095] Step S35: performing feature scaling processing on the feature matrix based on the constellation compression factor table to obtain an adjusted feature matrix (the adjusted feature matrix is the adjusted feature matrix obtained by scaling the feature matrix based on the constellation compression factor table according to the mapping relationship between the network behavior feature cluster and the physical feature cluster in S33 above);

[0096] For example, Table 3 below is an adjusted feature matrix obtained by performing feature scaling processing on the feature matrix of each signal source based on the compression factor table:

[0097] Signal source Cluster of physical characteristics Adjusted data packet retransmission rate Adjusted connection request latency coefficient of variation Adjusted encrypted handshake anomaly count AP1 Cluster 1 1.14 0.1425 0 AP3 Cluster 2 11.15 0.589 3.55

[0098] According to the above reasons, the constellation compression factor table performs feature scaling processing on the feature matrix, and taking the signal source 3 (i.e., AP3) as an example, the abnormal feature is attenuated (scaled from 15.7 to 11.15), and the influence on subsequent clustering is reduced.

[0099] Step S36: calculating the physical feature similarity of each two signal sources based on the distance from the current signal source to the corresponding physical feature cluster centroid coordinate; calculating the network behavior feature similarity based on the adjusted network behavior feature in the adjusted feature matrix corresponding to each two signal sources; and calculating the joint similarity based on the physical feature similarity and the network behavior feature similarity;

[0100] It should be noted that the above embodiment of the application is first based on the Mahalanobis distance of the centroid coordinates of the physical feature cluster corresponding to the i-th signal source to the i-th signal source to calculate the single-point physical feature similarity (the single-point physical feature similarity refers to the similarity of the centroid coordinates of a single signal source and its corresponding physical feature cluster), then calculate the physical feature similarity of each two single-point physical feature similarities (i.e. the sum of two single-point physical feature similarities divided by 2); then, the similarity of the combination of the adjusted network behavior features (i.e. the adjusted packet retransmission rate, the adjusted connection request time delay variation coefficient and the adjusted encryption handshake anomaly count) in the adjusted feature matrix of each two signal sources is calculated as the network behavior feature similarity; then, the physical feature similarity and the network behavior feature similarity are weighted and summed to obtain the joint similarity;

[0101] For example, Table 4 below is the generated joint similarity matrix:

[0102] AP1 AP2 AP3 AP1 1.00 0.92 0.15 AP2 0.92 1.00 0.18 AP3 0.15 0.18 1.00

[0103] In the above table 4, the intersection point of the horizontal signal source and the vertical signal source is the value of the joint similarity between the current two signal sources; it can be known from analyzing the above table 4 that the signal source 1 (i.e. AP1) and the signal source 2 (i.e. AP2) are highly similar, and the signal source 3 (i.e. AP3) is lowly similar to other points.

[0104] Step S37: based on the joint similarity matrix, the suspicious signal source is obtained by using spectral clustering optimization processing combined with cross-layer consistency checking processing analysis;

[0105] It should be noted that the above embodiment of the application first extracts network behavior features, constructs a data basis of protocol layer behavior features, then takes the physical feature cluster (hardware grouping) as the boundary, only performs behavior clustering on the signal sources in the same physical cluster, analyzes the behavior features under the physical grouping framework, and establishes a cross-layer mapping (i.e. the mapping table of the above behavior cluster and the physical cluster); the "normal behavior benchmark" of the physical cluster is quantified by constructing a feature matrix and calculating a centroid, which provides a reference for anomaly detection; then, the signal quality interference source is identified by calculating the constellation distortion and the constellation compression factor, and the noise influence of high distortion signals is suppressed; in the further scheme of step S35, the behavior feature weight is dynamically adjusted based on the signal quality by feature scaling processing, so that the high distortion signal feature is attenuated, the misjudgment caused by the signal quality is avoided, the abnormal information is preserved but the amplitude is reduced, and the clustering is dominated; then, the joint similarity matrix is generated by S36, the physical layer and the protocol layer similarity are fused, and a cross-layer correlation model is constructed; finally, the suspicious signal source is marked by spectral clustering optimization, and the high-confidence suspicious signal source is locked based on cross-layer consistency.

[0106] Specifically, in step S37, suspicious signal sources are analyzed based on the joint similarity matrix by using spectral clustering optimization processing combined with the cross-layer consistency checking processing, including the following operation steps:

[0107] Step S371: A three-layer feature tensor is constructed according to the physical feature matrix, the network behavior feature matrix and the physical feature cluster; and a cross-layer covariance is calculated based on the three-layer feature tensor;

[0108] It should be noted that in the three-layer feature tensor, the tensor slice represents the joint distribution of physical-behavior features of all signal sources in the physical feature cluster;

[0109] Step S372: Tensor singular value decomposition processing is performed on the three-layer feature tensor to extract a diagonal matrix; and a principal singular value is extracted from the diagonal matrix;

[0110] It should be noted that in the embodiment of the present application, the left singular matrix, the diagonal matrix and the right singular matrix are obtained by performing singular value decomposition processing on the three-layer feature tensor, and the elements on the diagonal line in the diagonal matrix are singular values of the three-layer feature tensor. In the embodiment of the present application, the singular values reflect the joint distribution of physical-behavior features of signal sources in the three-layer feature vector, and the principal singular value is obtained by extracting the singular values on the diagonal line of the diagonal matrix in the principal component extraction processing, to reflect the cross-layer correlation strength of the physical-behavior features of the signal sources.

[0111] Step S373: A signal source cross-layer deviation degree is calculated according to the principal singular value, the network behavior feature matrix, the physical feature matrix and the constellation distortion degree;

[0112] The calculation method of the signal source cross-layer deviation degree is as follows:

[0113] ;

[0114] In the formula, is the signal source cross-layer deviation degree of the i th signal source (the larger the value, the more suspicious); is the number of dimensions of the physical feature matrix; is the number of dimensions of the network behavior feature matrix; is the j th physical feature value of the i th signal source; is the k th network behavior feature value of the i th signal source; is the cross-layer feature expectation value of the m th physical feature cluster of the i th signal source; is the covariance of the j th physical feature and the k th network behavior feature of the m th physical feature cluster of the i th signal source (i.e., the correlation strength of the j th physical feature and the k th network behavior feature); is a natural constant (to prevent the denominator from being 0); the principal singular value of the mth physical feature cluster of the ith signal source; the sum of singular values of the mth physical feature cluster of the ith signal source;

[0115] It should be noted that the above embodiments of the present application quantize the relative degree of deviation of the signal source i from the expected value of the physical cluster in the product combination of the physical feature j and the behavior feature k, and use perform principal component weight distribution, then realize multi-dimensional joint evaluation by comprehensively calculating the weighted average deviation of all physical-behavior feature combinations, prevent suspicious signal sources caused by MAC cloning through physical layer (CFO) + behavior layer (retransmission rate) joint verification, prevent suspicious signal sources caused by hardware simulation through quantifying the damage degree of the association between hardware and protocol, and prevent suspicious signal sources caused by protocol stack impersonation through forcibly bind hardware and network behavior to prevent suspicious signal sources caused by protocol stack impersonation;

[0116] Step S374: Construct a Laplace matrix based on the signal source cross-layer deviation degree, the joint similarity matrix, and the constellation distortion degree; perform matrix solving on the Laplace matrix to obtain the first n eigenvectors v1, v2, v3... vn;

[0117] Step S375: Construct a projection matrix based on the first n eigenvectors; randomly generate a plurality of initial cluster centers z based on the projection matrix; cluster each signal source based on the minimum distance from each eigenvector vn to the initial cluster center z, and stop clustering when the clustering reaches a convergence condition, and output a plurality of clustering clusters;

[0118] Step S376: Perform multi-dimensional joint determination based on the signal source cross-layer deviation degree, the constellation distortion degree, and the eigenvectors vn in each clustering cluster to output suspicious signal sources;

[0119] The specific multi-dimensional joint determination method is as follows:

[0120] ;

[0121] In the above formula, the signal source cross-layer deviation degree of the ith signal source, the cross-layer deviation degree threshold; the constellation distortion degree threshold, baseband signature verification;

[0122] ​It should be noted that in the above embodiments of the present application, the signal source marked as a high-risk suspicious signal source has a large deviation degree and a failed baseband signature verification, and the medium-risk suspicious signal source has a large deviation degree or a high modulation distortion degree; the embodiments of the present application introduce the cross-layer deviation degree as a weight into clustering, so that the points with large deviation degrees (which may be anomalies) are more easily identified in the clustering process (may form small clusters or outliers), so that the subsequent threat judgment can be more focused on these abnormal clusters.

[0123] Specifically, in step S32, the network behavior feature vector is subjected to constraint hierarchical clustering analysis with the physical feature cluster as a grouping constraint condition, and then combined with behavior consistency analysis screening of the physical feature vector and the network behavior feature vector, a mapping relationship between the network behavior feature cluster and the physical feature cluster is output, including the following operation steps:

[0124] Step S321: identifying a cellular hot spot signal source and extracting a baseband modulation fingerprint corresponding to the cellular hot spot signal source, calculating a network behavior feature space compression factor based on the baseband modulation fingerprint;

[0125] Step S322: adjusting the behavior feature vector based on the space compression factor to obtain a second network behavior feature vector;

[0126] Step S323: constructing a joint similarity matrix based on the second network behavior feature vector and the physical feature vector; and performing secondary clustering processing based on the joint similarity matrix to generate a behavior consistency clustering cluster;

[0127] Step S324: screening the behavior consistency clustering cluster to obtain a behavior consistency clustering cluster with a cluster stability index greater than a physical behavior consistency threshold as a mapping relationship table between the behavior feature cluster and the physical feature cluster.

[0128] It should be noted that in the above embodiments of the present application, first, the cellular hot spot signal is used to distinguish the hot spot signal (such as a mobile phone hotspot) from the cellular network sharing and the ordinary WiFi signal. The cellular hot spot signal and the WiFi signal have different behavior features, so special processing is needed, that is, the baseband modulation fingerprint is extracted, the modulation layer features (such as modulation error) are obtained by analyzing the baseband modulation characteristics (such as constellation diagram), and then a space compression factor is calculated based on the baseband modulation fingerprint to adjust the weight of the behavior feature vector. For example, if the baseband modulation fingerprint shows that the signal quality is poor (distortion is large), it is considered that the behavior feature of the signal is unreliable, so the influence of the behavior feature in clustering is reduced by the compression factor, and the weight of the abnormal behavior feature caused by poor channel conditions or device hardware problems is reduced by adjusting the behavior feature by the compression factor, so as to avoid misjudgment of these conditions as malicious behavior.

[0129] Further, the original behavior feature vector is adjusted using the compression factor obtained in step S322, and the features are scaled according to the compression factor (for example, the feature value is reduced when the compression factor is less than 1, and the feature value is increased when the compression factor is greater than 1), to obtain a new behavior feature vector (a second network behavior feature vector). The adjusted behavior feature vector can better reflect the real device behavior, and exclude the distortion caused by channel or hardware problems, so that the subsequent clustering is more accurate.

[0130] The above steps comprehensively consider the adjusted behavior features and physical features, calculate the similarity between the signal sources, construct a joint similarity matrix, and perform clustering (for example, hierarchical clustering) using the joint similarity matrix to generate a new clustering cluster (referred to as a behavior consistency clustering cluster). This new clustering cluster simultaneously considers the features of the physical layer and the behavior layer, and detects signals that are inconsistent between the physical layer and the behavior layer through cross-layer joint clustering. For example, if devices (similar hardware) in the same physical cluster are divided into different behavior clusters, it may indicate that the behavior is abnormal, and thus is identified as suspicious. Further, the stability index (for example, the closeness of samples within the cluster) of each behavior consistency clustering cluster is calculated through the processing of step S325, and only the clustering cluster with high stability is retained as an effective mapping relationship, to ensure the reliability of the mapping relationship. Only stable mapping relationships are used, and signals with unclear mapping relationships (i.e., signals not in the stable cluster) can be directly regarded as abnormal in the subsequent cross-layer consistency verification, and thus are marked as suspicious signals.

[0131] The above embodiments of the present application realize clustering of behavior features under the constraint of physical grouping through steps S321-S325, establish a mapping relationship between the physical cluster and the behavior cluster, and use the mapping relationship for subsequent cross-layer consistency verification. If a signal source belongs to a certain cluster in the physical layer, but its behavior feature does not belong to the behavior cluster corresponding to the physical cluster, it is regarded as inconsistent and may be marked as suspicious. In addition, the behavior features are adjusted through the compression factor to improve the sensitivity to malicious signals, and the stability screening is used to ensure the reliability of the mapping and reduce false positives.

[0132] In addition, it should be noted that the spatial compression factor in step S322 in the above embodiments of the present application is essentially different from the compression factor in step S34. The spatial compression factor in step S322 is a pre-filter for the behavior feature space, which dynamically scales the feature vector through baseband distortion, and belongs to the category of data preprocessing. For example, the high-distortion signal of a malicious device is compressed by a weight (α=0.66), which is like wearing a noise reduction headset for noise data. The constellation compression factor in step S34 is a post-adjuster for the cross-layer deviation based on the covariance matrix, which normalizes the cross-layer deviation and belongs to the statistical processing technology. When the feature fluctuation is large (covariance 1.5), a larger deviation is allowed without triggering an alarm.

[0133] Specifically, in step S322, the cellular hot spot signal is identified and the baseband modulation fingerprint is extracted, and a network behavior feature space compression factor is calculated based on the baseband modulation fingerprint, including the following operation steps:

[0134] Step S3221: Analyze the SSID and MAC address in the signal source, match the SSID and MAC address with the cellular identification library, output the cellular marker vector of each signal source, and obtain the cellular signal source;

[0135] It should be noted that the cellular marker vector of the signal source is set to 1 when the SSID and MAC address of the signal source satisfy the matching condition of the cellular identification library, otherwise it is set to 0, so that the cellular signal source with the marker vector set to 1 (i.e. the cellular hot spot signal source) can be obtained.

[0136] Step S3222: Calculate the autocorrelation function of each cellular signal source based on the Schmidl-Cox algorithm, determine the OFDM symbol start position based on the autocorrelation function and the energy function; calculate the frequency offset estimation value by phase rotation of the pre-training sequence using the autocorrelation function of the OFDM symbol start position; and perform phase compensation on the cellular signal source using the frequency offset estimation value to obtain the compensated cellular signal source;

[0137] It should be noted that in the above embodiment of the present application, because the received signal is continuous, the start position of each OFDM symbol is determined to correctly segment, thereby improving the accuracy of subsequent suspicious signal source analysis; by using the Schmidl-Cox algorithm, which uses the autocorrelation of the training sequence (known repeated structure) to locate the OFDM symbol start point; in addition, due to the local oscillator frequency deviation and Doppler effect between the transmitting end and the receiving end, the signal has a carrier frequency offset, which causes the constellation diagram to rotate, the frequency offset is estimated by using the phase rotation information of the training sequence, and then the cellular signal source is phase compensated using the frequency offset estimation value to obtain the compensated cellular signal source, which eliminates the time offset and frequency offset in the signal transmission process and establishes a reference coordinate system for accurate analysis; in addition, it should be noted that in the compensated cellular signal source, the segmented signal is processed and adjusted for compensation, therefore, the compensated cellular signal source is displayed in a segmented form, for example, Ri={r1, r2,... rn}.

[0138] Step S3223: Perform FFT transform processing on each symbol segment in the compensated cellular signal source, and extract the data subcarrier volume after the transform processing; perform phase rotation processing on each data subcarrier component by the optimal rotation angle to obtain the corrected data subcarrier component;

[0139] It should be noted that in the above embodiment of the present application, the symbol segment of the compensated cellular signal source is composed of a plurality of subcarriers in the frequency domain, and each subcarrier is modulated with a data symbol, so it is necessary to convert to the frequency domain for analysis. Therefore, the embodiment of the present application extracts the data subcarrier component by FFT transformation processing. In addition, although the common carrier frequency offset is compensated in step S3222, there may still be residual phase shift on each subcarrier (due to channel phase response, etc.). Therefore, the embodiment of the present application corrects by performing phase rotation processing on each data subcarrier component by the optimal rotation angle to obtain the corrected data subcarrier component. Specifically, the optimal rotation angle of the data subcarrier component is found, and then the data subcarrier component is phase-rotated according to the optimal rotation angle to eliminate the phase rotation caused by the channel, so that the distribution of the corrected data subcarrier component reflects the modulation characteristics of the device itself.

[0140] Step S3224: Calculate the minimum Euclidean distance between each two corrected data subcarrier components; distribute the minimum Euclidean distance into a preset interval to obtain an Euclidean distance histogram; calculate the data subcarrier component distortion degree based on the Euclidean distance histogram, the number of corrected data subcarrier components, and the preset data subcarrier component mean value.

[0141] Step S3226: Perform cellular compensation on the cellular signal source according to the data subcarrier component distortion degree to obtain a spatial compression factor.

[0142] It should be noted that in the above embodiment of the present application, first, the SSID (network name) and MAC address (hardware address) in the beacon frame are analyzed and compared with the predefined cellular identifier library to distinguish between operator devices (mobile phone hotspots) and ordinary WiFi devices (routers), avoiding misjudgment of operator devices as malicious signals. For example, a user's mobile phone hotspot (f_i=1) in a shopping mall will not be misjudged. Further, in step S3222, time-frequency synchronization is used to compensate and optimize the time misalignment and frequency drift in signal transmission, establish a reference coordinate system for accurate analysis, and eliminate constellation rotation caused by environmental interference. Further, through subcarrier correction processing, the channel influence and device inherent characteristics are separated to extract a pure hardware modulation fingerprint. Then, in S3224, the degree of device modulation defects is quantified by the distortion measure of the data subcarrier component to provide a basis for behavior feature compression, directly reflecting hardware abnormalities. Finally, in S3225, the behavior feature weight is dynamically adjusted according to the modulation quality to suppress the influence of high-suspected signals on clustering.

[0143] Embodiment Two

[0144] As Figure 6As shown, in another aspect, the second embodiment of the present application is based on the suspicious WiFi signal source detection method based on multi-source signal fusion provided in the first embodiment of the present application, and further provides a suspicious WiFi signal source detection system based on multi-source signal fusion, comprising a feature acquisition module 10, a first clustering module 20, a second clustering and marking module 30, and an evaluation module 40.

[0145] The feature acquisition module 10 is configured to acquire the radio frequency physical features and network behavior features of the WiFi signal sources in the target area.

[0146] The first clustering module 20 is configured to group the radio frequency physical features by using a first clustering algorithm to generate a physical feature cluster.

[0147] The second clustering and marking module 30 is configured to mark the suspicious signal sources by using a second clustering algorithm based on the network behavior features of the physical feature cluster and cross-layer consistency verification.

[0148] The evaluation module 40 is configured to analyze and process the suspicious signal sources based on the local baseband signature authentication and the regional security level to generate a signal security evaluation report.

[0149] In summary, the suspicious WiFi signal source detection method and system based on multi-source signal fusion provided in the present application are constructed from two dimensions of the hardware physical layer and the network protocol layer by using the methods of hierarchical feature acquisition, step-by-step clustering fusion, and cross-layer consistency verification, a "multi-dimensional signal portrait" of the WiFi signal source is constructed, and the suspicious signal sources (such as malicious APs and phishing hotspots) that are disguised or abnormal are detected by comparing whether the features of the two layers are consistent (whether they come from the same real device).

[0150] In specific implementation, the cross-layer mapping of the network behavior features and the physical layer is established based on the physical feature cluster, the signal quality interference source is identified by calculating the constellation diagram distortion degree and the constellation diagram compression factor, the feature matrix is scaled, the suspicious signal source is marked by using the spectral clustering optimization based on the calculation of the joint similarity, and the high-confidence suspicious signal source is locked based on the cross-layer consistency;

[0151] Further, the subsequent threat determination can be more focused on these abnormal clusters by calculating the cross-layer deviation degree of the signal sources in the physical layer and the network behavior feature layer.

[0152] Further, the spatial compression factor of the cellular hotspots is introduced to identify and perform secondary clustering processing based on the joint similarity matrix to generate the behavior consistency clustering cluster, and the clustering cluster with high stability is screened and reserved as an effective mapping relationship, so as to ensure the reliability of the mapping relationship.

[0153] Further, through transformation and correction and compensation processing of the cellular signal source, a spatial compression factor is obtained, and a behavior characteristic weight is dynamically adjusted according to modulation quality, so as to suppress the influence of high-suspected signals on clustering.

[0154] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; the ordinary skilled in the art can modify the technical solutions described in the above embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting suspicious WiFi signal sources based on multi-source signal fusion, characterized in that, The following steps are included: Collect the radio frequency physical characteristics and network behavior characteristics of WiFi signal sources within the target area; The radio frequency physical features are grouped using a first clustering algorithm to generate physical feature clusters; Suspicious signal sources are identified by combining network behavior characteristics with cross-layer consistency checks on physical feature clusters using a second clustering algorithm. Based on the analysis and processing of suspicious signal sources through local baseband signature authentication and regional security level, a signal security assessment report is generated. The second clustering algorithm, based on network behavior characteristics and combined with cross-layer consistency checks, identifies suspicious signal sources. The steps include: Calculate the network behavior feature vector based on the network behavior characteristics; calculate the physical feature vector based on the radio frequency physical characteristics; Using physical feature clusters as grouping constraints, constrained hierarchical clustering analysis is performed on network behavior feature vectors. Then, combined with the behavior consistency analysis of physical feature vectors and network behavior feature vectors, the mapping relationship between network behavior feature clusters and physical feature clusters is output. Based on the mapping relationship between network behavior feature clusters and physical feature clusters, a feature matrix is ​​established; The mean value of the network behavior feature vector of the signal source within the physical feature cluster is recorded as the centroid coordinate of the physical feature cluster. Then, the centroid coordinates corresponding to the signal sources within multiple physical feature clusters are collected to form a set of centroid coordinates of the physical feature cluster. The joint similarity between each pair of signal sources is calculated by combining the IQ sampling data of each signal source with the centroid coordinate set of the physical feature cluster and the feature matrix; a joint similarity matrix is ​​constructed based on the joint similarity. Suspicious signal sources are identified based on the joint similarity matrix using spectral clustering optimization combined with cross-layer consistency checks. The steps include: A three-layer feature tensor is constructed based on the physical feature matrix, the network behavior feature matrix, and the physical feature cluster; cross-layer covariance is calculated based on the three-layer feature tensor. Tensor singular value decomposition is performed on the three-layer feature tensor to extract the diagonal matrix; principal singular values ​​are then extracted from the diagonal matrix. Suspicious signal sources are obtained by combining the main singular value with cross-layer deviation analysis of the signal source and multi-dimensional joint judgment output based on projection clustering. Suspicious signal sources are identified by combining cross-layer deviation analysis of the signal source with multidimensional joint determination output based on projection clustering, based on the principal singular value, including the following steps: The cross-layer deviation of the signal source is calculated based on the principal singular value, network behavior feature matrix, physical feature matrix, and constellation diagram distortion. The calculation method for the cross-layer deviation of the signal source is as follows: ； In the formula, The signal source cross-layer deviation of the i-th signal source; The number of dimensions of the physical feature matrix; The number of dimensions in the network behavior feature matrix; Let j be the physical characteristic value of the i-th signal source; This represents the k-th network behavior feature value of the i-th signal source. Let be the expected value of the cross-layer features of the m-th physical feature cluster of the i-th signal source; Let be the covariance between the j-th physical feature of the m-th physical feature cluster of the i-th signal source and the k-th network behavior feature; It is a natural constant; Let be the principal singular value of the m-th physical feature cluster of the i-th signal source; It is the sum of the singular values ​​of the m-th physical feature cluster of the i-th signal source; A Laplacian matrix is ​​constructed based on the signal source cross-layer deviation, joint similarity matrix, and constellation diagram distortion; the Laplacian matrix is ​​solved to obtain the first n eigenvectors v1, v2, v3...vn; Construct a projection matrix based on the first n feature vectors; randomly generate multiple initial cluster centers z based on the projection matrix; cluster each signal source based on the minimum distance from each feature vector vn to the initial cluster center z, and stop clustering when the clustering reaches the convergence condition, and output multiple clusters; Suspicious signal sources are obtained through multi-dimensional joint determination based on the cross-layer deviation of signal sources in each cluster and the distortion of the constellation diagram. The specific multi-dimensional joint determination method is as follows: ； In the above formula, Let be the cross-layer deviation of the signal source for the i-th signal source. The threshold for cross-layer deviation; The threshold for constellation diagram distortion. This is for baseband signature verification.

2. The method for detecting suspicious WiFi signal sources based on multi-source signal fusion according to claim 1, characterized in that, The joint similarity between any two signal sources is calculated by combining the IQ sampling data of each signal source with the centroid coordinate set of the physical feature cluster. The steps include the following: Extract the 64-QAM constellation points of OFDM symbols from the IQ sampling data of each signal source, calculate the constellation diagram distortion based on the 64-QAM constellation points, and obtain the constellation diagram compression factor based on the constellation diagram distortion. A constellation graph compression factor table is constructed based on the constellation graph compression factor. The feature matrix is ​​scaled based on the constellation graph compression factor table to obtain the adjusted feature matrix. The physical feature similarity between each two signal sources is calculated based on the distance from the current signal source to the centroid coordinates of the corresponding physical feature cluster; the network behavior feature similarity is calculated based on the adjusted network behavior features in the adjusted feature matrix corresponding to each two signal sources; and the joint similarity is calculated based on the physical feature similarity and the network behavior feature similarity.

3. The method for detecting suspicious WiFi signal sources based on multi-source signal fusion according to claim 2, characterized in that, Using physical feature clusters as grouping constraints, constrained hierarchical clustering analysis is performed on network behavior feature vectors. Then, combined with behavioral consistency analysis of physical feature vectors and network behavior feature vectors, the mapping relationship between network behavior feature clusters and physical feature clusters is output, including the following steps: Identify cellular hotspot signal sources and extract the corresponding baseband modulation fingerprints. Calculate the spatial compression factor of network behavior features based on the baseband modulation fingerprints. The second network behavior feature vector is obtained by adjusting the behavior feature vector in reverse based on the spatial compression factor. A joint similarity matrix is ​​constructed based on the second network behavior feature vector and physical feature vector; a secondary clustering process is performed based on the joint similarity matrix to generate behavior-consistent clusters; After filtering behaviorally consistent clusters whose cluster stability index is greater than the physical behavioral consistency threshold, a mapping table between behavioral feature clusters and physical feature clusters is generated based on these clusters.

4. The method for detecting suspicious WiFi signal sources based on multi-source signal fusion according to claim 3, characterized in that, Identifying cellular hotspot signals and extracting baseband modulation fingerprints, and calculating the network behavior feature spatial compression factor based on the baseband modulation fingerprints, includes the following steps: The SSID and MAC address in the signal source are parsed, and the SSID and MAC address are matched with the cellular identifier database to output the cellular tag vector of each signal source, thus obtaining the cellular signal source; The autocorrelation function of each cellular signal source is calculated based on the Schmidl-Cox algorithm, and the starting position of OFDM symbols is determined based on the autocorrelation function and the energy function. The frequency offset estimate is calculated by using the autocorrelation function of the OFDM symbol start position and the phase rotation of the pre-trained sequence; Phase compensation is performed on the cellular signal source using the frequency offset estimate to obtain the compensated cellular signal source; The spatial compression factor is obtained by combining transformation correction processing with distortion compensation processing based on the symbol segments in the compensated cellular signal source.

5. The method for detecting suspicious WiFi signal sources based on multi-source signal fusion according to claim 4, characterized in that, Based on the symbol segments in the compensated cellular signal source, the spatial compression factor is obtained through transform correction and distortion compensation operations, including the following steps: FFT transformation is performed on each symbol segment in the compensated cellular signal source, and the transformed data subcarrier components are extracted; each data subcarrier component is phase rotated by the optimal rotation angle to obtain the corrected data subcarrier components. Calculate the minimum Euclidean distance between every two corrected data subcarrier components; distribute the minimum Euclidean distances into a preset interval to obtain an Euclidean distance histogram; The distortion of the data subcarrier components is calculated based on the Euclidean distance histogram, the number of corrected data subcarrier components, and the preset mean value of the data subcarrier components. Cellular compensation is performed on the cellular signal source based on the distortion of the data subcarrier components to obtain the spatial compression factor.

6. A suspicious WiFi signal source detection system based on multi-source signal fusion, characterized in that, It includes a feature acquisition module, a first clustering module, a second clustering and labeling module, and an evaluation module; The feature acquisition module is used to acquire the radio frequency physical characteristics and network behavior characteristics of WiFi signal sources within the target area; the first clustering module is used to group the radio frequency physical characteristics using a first clustering algorithm to generate physical feature clusters; the second clustering and labeling module is used to label suspicious signal sources by combining network behavior characteristics with cross-layer consistency checks on the physical feature clusters using a second clustering algorithm; the evaluation module is used to analyze and process suspicious signal sources based on local baseband signature authentication and regional security levels to generate a signal security evaluation report; specifically, the second clustering and labeling module is used to calculate network behavior feature vectors based on the network behavior characteristics and calculate physical feature vectors based on the radio frequency physical characteristics; Using physical feature clusters as grouping constraints, constrained hierarchical clustering analysis is performed on network behavior feature vectors. Then, combined with the behavior consistency analysis of physical feature vectors and network behavior feature vectors, the mapping relationship between network behavior feature clusters and physical feature clusters is output. Based on the mapping relationship between network behavior feature clusters and physical feature clusters, a feature matrix is ​​established; The mean value of the network behavior feature vector of the signal source within the physical feature cluster is recorded as the centroid coordinate of the physical feature cluster. Then, the centroid coordinates corresponding to the signal sources within multiple physical feature clusters are collected to form a set of centroid coordinates of the physical feature cluster. The joint similarity between each pair of signal sources is calculated by combining the IQ sampling data of each signal source with the centroid coordinate set of the physical feature cluster and the feature matrix; a joint similarity matrix is ​​constructed based on the joint similarity. Suspicious signal sources are obtained by combining spectral clustering optimization with cross-layer consistency testing based on the joint similarity matrix; the second clustering and labeling module is also used to construct a three-layer feature tensor based on the physical feature matrix, network behavior feature matrix and physical feature cluster; and to calculate the cross-layer covariance based on the three-layer feature tensor. Tensor singular value decomposition is performed on the three-layer feature tensor to extract the diagonal matrix; principal singular values ​​are then extracted from the diagonal matrix. Suspicious signal sources are obtained by combining the main singular value with cross-layer deviation analysis of the signal source and multi-dimensional joint judgment output based on projection clustering. The second clustering and labeling module is also used to calculate the cross-layer deviation of the signal source based on the principal singular values, network behavior feature matrix, physical feature matrix, and constellation diagram distortion; the calculation method for the cross-layer deviation of the signal source is as follows: ； In the formula, The signal source cross-layer deviation of the i-th signal source; The number of dimensions of the physical feature matrix; The number of dimensions in the network behavior feature matrix; Let j be the physical characteristic value of the i-th signal source; This represents the k-th network behavior feature value of the i-th signal source. Let be the expected value of the cross-layer features of the m-th physical feature cluster of the i-th signal source; Let be the covariance between the j-th physical feature of the m-th physical feature cluster of the i-th signal source and the k-th network behavior feature; It is a natural constant; Let be the principal singular value of the m-th physical feature cluster of the i-th signal source; It is the sum of the singular values ​​of the m-th physical feature cluster of the i-th signal source; A Laplacian matrix is ​​constructed based on the signal source cross-layer deviation, joint similarity matrix, and constellation diagram distortion; the Laplacian matrix is ​​solved to obtain the first n eigenvectors v1, v2, v3...vn; Construct a projection matrix based on the first n feature vectors; randomly generate multiple initial cluster centers z based on the projection matrix; cluster each signal source based on the minimum distance from each feature vector vn to the initial cluster center z, and stop clustering when the clustering reaches the convergence condition, and output multiple clusters; Suspicious signal sources are obtained through multi-dimensional joint determination based on the cross-layer deviation of signal sources in each cluster and the distortion of the constellation diagram. The specific multi-dimensional joint determination method is as follows: ； In the above formula, Let be the cross-layer deviation of the signal source for the i-th signal source. The threshold for cross-layer deviation; The threshold for constellation diagram distortion. This is for baseband signature verification.

Images