System and method for network security attack and defense demonstration based on WIFI

Abstract

The invention relates to the technical field of communication equipment, in particular to a system and method for network security attack and defense demonstration based on WIFI, and the system comprises a calculation control module which is used for carrying out centralized control and scheduling on the attack and defense demonstration process of the whole system; the WIFI detection module is used for actively detecting and passively monitoring a wireless network in a specified area under the control of the calculation control module so as to obtain information, a security protocol and an MAC address request of a wireless access point; the defense simulation module completes corresponding simulation counterattack operation according to the abnormal data; and the attack simulation module is used for carrying out simulation attack operation on the wireless network in the specified area under the active control of the calculation control module. The method is used for learners to realize potential risks and skillfully grasp various WIFI attack and defense technologies, and is simple and convenient to construct.

Description

Technical Field

[0001] This invention relates to the field of communication equipment technology, and in particular to a system and method for demonstrating network security attack and defense based on WIFI. Background Technology

[0002] In today's digital age, the widespread application of wireless networks has fundamentally changed people's lives and work patterns. It has become a key infrastructure for information exchange, acting like invisible bridges that tightly connect various smart devices, enabling data to be transmitted quickly and conveniently between different terminals. Whether it's individuals using mobile phones, tablets, and other devices to connect to wireless networks for social interaction, shopping, and entertainment in their daily lives, or businesses using wireless networks to automate office processes, facilitate remote collaboration, and share data, or even for government information transmission and remote monitoring of critical infrastructure, wireless networks play an indispensable role.

[0003] However, the openness and convenience of wireless networks also expose them to numerous security threats. Their security directly impacts the security of personal privacy and corporate secrets. For individual users, if a wireless network is hacked, sensitive personal information such as bank account passwords, social media account information, personal photos and videos may be stolen, leading to serious consequences such as financial losses, reputational damage, and privacy breaches. At the corporate level, confidential data, including business plans, financial statements, and customer information, could suffer significant economic losses if leaked through insecure wireless network transmission. While a Wi-Fi attack and defense exercise platform is intended for teaching, training, or practical simulation, existing platforms are complex to set up, requiring substantial hardware investment and significant costs.

[0004] Therefore, those skilled in the art are dedicated to developing a system and method for demonstrating network security attack and defense based on WIFI, so that learners can be aware of potential risks, master various WIFI attack and defense technologies, and the system is easy to set up. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a system and method for demonstrating network security attack and defense based on WIFI, so that learners can realize potential risks, master various WIFI attack and defense technologies, and the system is easy to set up.

[0006] The technical solution of this invention to solve the above-mentioned technical problems is as follows: A system for demonstrating network security attack and defense based on WIFI, comprising... The computing control module is a platform for running attack and defense exercises, used to centrally control and schedule the entire system's attack and defense demonstration process. A WIFI detection module, which is communicatively connected to the computing control module, is used to actively detect and passively listen to the wireless network in a designated area under the control of the computing control module to obtain information about wireless access points, security protocols, and MAC address requests. If counterfeit access points or malicious hotspots appear in the information of wireless access points; Security protocols have vulnerabilities that can be exploited, leading to attacks that exploit vulnerabilities in the protocols themselves. When a MAC address request involves one or more of network reconnaissance or address spoofing, the WIFI detection module will again acquire terminal behavior data and application traffic statistics, and then parse them to obtain system data. The defense simulation module is communicatively connected to the computing control module. The defense simulation module has a built-in index range for the system data. If the system data is not within the corresponding range value, it is marked as abnormal data. The defense simulation module performs corresponding simulated counterattack operations based on the abnormal data. An attack simulation module, which is communicatively connected to the computing control module, is used to perform simulated attack operations on a wireless network in a specified area under the active control of the computing control module.

[0007] The beneficial effects of adopting the above scheme are: through centralized scheduling of the computing control module, the integrated attack and defense exercise is realized. Its dynamic trigger-based deep detection mechanism only activates the secondary collection of terminal behavior data and application traffic after detecting threats such as spoofed access points or protocol downgrade attacks. This avoids the resource consumption of continuous monitoring and can accurately capture the details of trainees' attack methods during training. The defense simulation module has built-in indicator ranges, forming a closed loop of "anomaly marking - automatic counterattack". It can automatically simulate blocking and isolation when address spoofing is detected without the need for teachers to manually configure countermeasures. This solves the problem of slow response of traditional platforms. The modular and decoupled architecture allows attack simulation and defense simulation to run independently. Operators can switch between phishing WIFI and enterprise security WIFI training environments with one click. The system automatically completes the linkage and arrangement of attack initiation and defense response without rewiring or hardware replacement, which significantly reduces teaching costs and improves the efficiency of scenario reproduction.

[0008] Based on the above technical solution, the present invention can be further improved as follows.

[0009] Furthermore, the WIFI detection module obtains current behavior data based on the terminal behavior data and compares the current behavior data with the set behavior data through the behavior prediction model to obtain the difference value. If the difference value exceeds the indicator range, it is marked as the first system data. The WIFI detection module obtains metadata based on application traffic statistics, including transport layer protocol type, source / destination port number, data packet size, transmission direction and timestamp. The extracted metadata is subjected to protocol decoding and session reassembly, and multi-dimensional traffic features are constructed based on the reassembled session stream. The multi-dimensional traffic features include connection frequency per unit time, uplink and downlink traffic ratio, proportion of specific protocol data packets, and distribution pattern of data packet size. The multidimensional traffic features are matched with the set multidimensional traffic, and the deviation from the normal behavior baseline is calculated. If a specific attack rule is matched or the deviation exceeds a preset threshold, it is marked as second system data.

[0010] The beneficial effects of adopting the above-mentioned further scheme are: by uniformly collecting terminal behavior data, three types of anomaly detection can be achieved; the correlation analysis between MAC address switching frequency and RSSI fluctuation pattern can identify intermittent scanning behavior in public WiFi that uses randomization technology to bypass MAC filtering, and mark it as the first system data; Modeling the timing of associated requests and channel switching logic can distinguish between unauthentication attacks by attackers mixed in with normal customer flow in high-density shopping mall environments. Marking is completed by abrupt changes in terminal reconnection intervals. The deviation between power control behavior and sleep / wake cycle can be calculated to detect energy-saving mode deception that uses disguised power-saving polling frames to maintain illegal online status. Meanwhile, the unified construction of multi-dimensional traffic features enables two types of deep analysis: based on the burst timing of EAPOL frames and the jump features of the WPS negotiation phase, the pin code segmentation brute-force cracking during non-working periods of the enterprise network is identified and marked as second system data; By weighting the asymmetry of uplink and downlink traffic with TCP retransmission rate, man-in-the-middle attacks can be identified in AP scenarios where uplink signaling is normal but downlink service data is abnormally attenuated. Combined with the 802.11 acknowledgment mechanism and cross-verification of transport layer sequence numbers, the marking is completed. The mechanism transforms anomalies at the protocol layer, behavior layer, and traffic layer into mutually verifiable threat confidence levels, solving the problem of defense lag caused by the inability of traditional defense systems to detect wireless layer reconnaissance activities that have not triggered IP communication. This achieves a technological shift from passive response to proactive prediction.

[0011] Furthermore, the defense simulation module includes: The defense submodule is used to set up detection points at the wireless network boundary, access layer and data layer respectively, and to perform layered detection and graded response on the system data. When abnormal data breaks through the first layer detection point, it triggers the deep protocol analysis and behavior verification of the second layer detection point. If it breaks through the preset number of detection points consecutively, it is determined to be abnormal data. The data isolation submodule is used to identify and mark the core data in the system data. The core data includes user authentication information, encryption keys and management instructions. The core data is stored in encryption, access permissions are graded and network areas are isolated. When an abnormal access request is detected, multiple authentication and operation audits are performed. If the number of authentication failures exceeds the threshold, the data link of the request is cut off and the corresponding core data access permissions are locked.

[0012] The beneficial effects of adopting the above-mentioned further solutions are as follows: The defense submodule transforms the system data flow into a progressively trust-evaluated object through a layered detection architecture of the wireless network boundary, access layer, and data layer. When the boundary layer detects an abnormal MAC address change, it triggers the EAPOL replay verification of the access layer. If the data layer also detects an abnormal key negotiation, it makes a comprehensive judgment, thus solving the problem of core data exposure caused by single-point failure in traditional wireless defense. The data isolation submodule uniformly marks the authentication information and encryption keys in the system data and achieves triple protection through encrypted storage, hierarchical access control, and regional isolation. When abnormal access is detected, the verification strength is dynamically upgraded and the link is cut off and the access is locked. In the scenario of remote monitoring of critical infrastructure, it can resist the lateral movement of attackers after stealing management instructions. Even if the network layer detection is breached, the attacker cannot obtain a valid key. Compared with the traditional solution that only defends at the IP layer, this invention extends the defense depth to the semantics of wireless management frames and the lifecycle management of key materials, achieving a systematic effect from boundary protection to core data self-protection.

[0013] Furthermore, the simulated counterattack operations performed by the defense simulation module include: Based on the data from the first system, perform password cracking attacks, spoofed access point attacks, or denial-of-service attacks on the target wireless network. Based on the data from the second system, simulate malware behavior, wireless eavesdropping and man-in-the-middle attacks or resource exhaustion attacks, and build device behavior profiles or monitor malicious traffic patterns.

[0014] The beneficial effects of adopting the above-mentioned further solutions are as follows: The defense simulation module transforms the abnormal terminal behavior of the first system data into active attack simulations of password cracking and spoofing access points through a differentiated response mechanism, and transforms the abnormal traffic characteristics of the second system data into simulations of malicious software behavior and wireless eavesdropping demonstrations. It uses device behavior profiling and malicious traffic pattern monitoring as counter-attack operations rather than simple detection methods. In the scenario of wireless inspection of unattended substations in the energy and power system, when an abnormal MAC address change of the inspection robot is detected, the system immediately spoofs a legitimate AP to launch a de-authentication attack on the virtual mirror network, replicating the risk of attackers hijacking control commands. Simultaneously, based on the EAPOL frame burst patterns discovered by traffic monitoring, it dynamically constructs a malicious node profile and reverse-generates customized attack payloads targeting key reinstallation vulnerabilities. Compared to the passive mode of traditional defense platforms that only block or alarm, this is a significant improvement. This invention achieves a self-evolving training loop of defense intelligence-driven attack simulation by feeding back detection data to attack strategies in real time, enabling security personnel to rehearse the complete path of attackers using zero-day vulnerabilities to laterally penetrate the relay protection system.

[0015] Furthermore, the construction of the device behavior profile includes: The MAC address request is parsed to obtain device fingerprint information, which includes device type, operating system, and network card manufacturer identifier. Feature extraction is performed on the application traffic statistics, including connection frequency, access time distribution, protocol usage preference, and data packet length distribution. Based on the device fingerprint information and the feature extraction results, a device baseline behavior model is generated through a clustering algorithm, and risk weights are assigned to different feature dimensions. The real-time collected system data is compared with the device baseline behavior model to calculate the behavior deviation. When the behavioral deviation exceeds a preset threshold, the device behavior profile is updated, stored, and marked as a suspicious device, triggering a corresponding simulated attack operation.

[0016] The beneficial effects of adopting the above-mentioned further solutions are: the device behavior profile construction obtains the device fingerprint by uniformly parsing MAC address requests, and transforms the device type, operating system and network card manufacturer identifier into anchor points of the baseline model. At the same time, dynamic features are constructed by extracting connection frequency and access time distribution from application traffic statistics. A unified collection mechanism is used to achieve cross-validation of fingerprint static attributes and behavior dynamic attributes without increasing hardware overhead. After automatically generating a baseline using clustering algorithms, the system proactively assigns differentiated risk weights to feature dimensions such as protocol usage preferences and packet length distribution, rather than pre-setting fixed thresholds. For example, in a smart campus scenario, when a large number of student terminals suddenly exhibit BLE protocol mixed traffic during lunch breaks, and the packet length distribution deviates from the baseline of video applications, the system determines that attackers are using IoT devices to conduct covert channel penetration. It then updates the profile and triggers a man-in-the-middle attack simulation on a virtual mirror network, reproducing the risk of attackers hijacking the smart lock authentication process. Compared to traditional solutions that only use profiles for static auditing, this invention couples behavioral deviation calculation with simulated attack operations in a closed loop, achieving proactive defense from anomaly detection to threat pre-simulation, solving the problem of attack scenario lag caused by the highly dynamic nature of terminal behavior in attack and defense drills.

[0017] Furthermore, the attack simulation module includes: The hotspot management unit is used to add fake Wi-Fi hotspots and manage virtual login users. Password cracking unit, used to perform WIFI password cracking operations; Signal jamming unit, used to generate jamming signals required for denial-of-service attacks; The protocol vulnerability exploitation unit is used to launch simulated attacks against known vulnerabilities in the WIFI communication protocol.

[0018] The beneficial effects of adopting the above-mentioned further solution are as follows: The attack simulation module uniformly constructs spoofed WIFI hotspots and virtual login users through the hotspot management unit, achieving the dual effects of access point spoofing and client simulation without increasing hardware nodes. It coordinates password cracking, signal interference, and protocol vulnerability exploitation into a complete attack chain. The protocol vulnerability exploitation unit does not operate independently but uses the spoofed hotspots generated by the hotspot management unit as attack springboards. When the signal interference unit creates channel congestion, it launches a key reinstallation attack targeting the four-way handshake vulnerability, forming a composite attack scenario with spatiotemporal overlap. For example, in a chain retail scenario, attackers can spoof the WIFI at the mall's cashier and simulate a large number of virtual users accessing the network. Simultaneously, they can exploit the WPS vulnerability to crack the backend network password. The system then launches a man-in-the-middle attack on the mirror network of the payment terminal, reproducing the risk of transaction data hijacking. Compared to traditional training tools that only support single attack vector testing, this invention achieves a leap from single-point penetration demonstration to cross-layer attack chain pre-rehearsal by deeply coupling spoofed user behavior with protocol stack vulnerability exploitation, solving the problem that fragmented attack scenarios in attack and defense exercises cannot reproduce the real APT attack path.

[0019] Furthermore, the simulated attack operations performed by the attack simulation module include: The system data is actively analyzed and processed, including data cleaning, protocol parsing, and vulnerability feature matching. Based on the results of the active analysis and processing, security vulnerabilities of the target wireless network are identified, including weak encryption algorithms, unpatched protocol vulnerabilities, and default configuration defects. The computational control module generates an attack strategy based on the identified security vulnerabilities and actively triggers the attack simulation module to execute the corresponding simulated attack operations.

[0020] The beneficial effects of adopting the above-mentioned further solution are as follows: The attack simulation module actively analyzes and processes system data, transforming data cleaning, protocol parsing, and vulnerability feature matching into intelligence generation methods for the attacker side. It uses identified security weaknesses to drive the autonomous generation of attack strategies, rather than pre-setting fixed attack vectors. For example, in a medical IoT scenario, when the system detects that a monitor access point still uses the disabled WEP encryption, it automatically extracts its default configuration flaws and generates a key recovery attack strategy, subsequently triggering a deauthentication attack and man-in-the-middle hijacking simulation against the device, reproducing the complete path of the attacker stealing the patient's vital signs data. Compared to traditional training platforms that require manual configuration of attack parameters, this invention, by feeding back the protocol parsing results to the attack decision engine in real time, achieves intelligent training that moves from passively executing scripts to actively perceiving target weaknesses and dynamically orchestrating attack chains. This solves the problem of the disconnect between attack strategies and the actual vulnerability status of the target in attack and defense confrontation, enabling security personnel to rehearse real-world scenarios where attackers exploit configuration drift to launch precise strikes.

[0021] Furthermore, it also includes a visualization module and an antenna module. The visualization module is communicatively connected to the computing control module and is used to display in real time the network information acquired by the WIFI detection unit, the attack process and status of the attack simulation unit, and the security status of the network. The antenna module is connected to the WIFI detection unit and / or the attack simulation unit to enhance the reception and transmission power of wireless signals.

[0022] The beneficial effects of adopting the above-mentioned further solutions are: the visualization module transforms abstract protocol interactions into real-time network topology and attack animations; and the antenna module, by enhancing reception and transmission power, expands to simulate wall-penetrating environments without increasing the number of network cards, thus synergistically enhancing signal coverage and exercise visualization.

[0023] The present invention also provides a method for demonstrating network security attack and defense based on WIFI, using any of the systems described above for demonstrating network security attack and defense based on WIFI. Attached Figure Description

[0024] Figure 1 This is a schematic block diagram of the hardware module in an embodiment of the present invention. Detailed Implementation

[0025] The following will describe the concept and technical effects of the present invention clearly and completely with reference to embodiments, so as to fully understand the purpose, features and effects of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are all within the scope of protection of the present invention.

[0026] like Figure 1 As shown, a system for demonstrating network security attack and defense based on WIFI includes... The computational control module serves as the platform for running attack and defense exercises. Built on a centralized control architecture, it includes a central scheduling engine, a data storage unit, an instruction parsing module, and a strategy library management unit. The central scheduling engine employs a multi-threaded concurrent processing mechanism to support synchronous responses from multiple modules. The data storage unit utilizes a distributed database for efficient storage and retrieval of exercise data. The instruction parsing module uses regular expressions and protocol parsing algorithms to translate upper-layer control instructions into lower-level instructions executable by each module. The strategy library management unit includes pre-set attack and defense strategy templates and supports user-defined strategy input. Through this architecture and components, the computational control module achieves centralized control and scheduling of the entire system's attack and defense demonstration process. The WIFI detection module communicates with the computing control module and integrates a wireless network card control unit, a detection engine, a data parsing unit, and a threat identification unit. The wireless network card control unit can switch the network card to promiscuous mode to achieve full-channel data capture. The detection engine integrates a dual-mode working mechanism of active detection and passive monitoring. Active detection sends Probe Request frames based on the IEEE 802.11 protocol and obtains wireless access point information by receiving Probe Response frames and Beacon broadcast frames from the access point (AP). Passive monitoring achieves interference-free data acquisition by continuously capturing communication frames from various channels in the 2.4G / 5G frequency bands. The data parsing unit uses Deep Packet Inspection (DPI) technology to parse the captured frame data. The threat identification unit has built-in databases of spoofed AP signatures, protocol vulnerability signatures, and abnormal MAC address behavior signatures. Under the control of the computing control module, the WIFI detection module actively detects and passively monitors wireless networks in a designated area to obtain information about wireless access points, security protocols, and MAC address requests.

[0027] In specific operation, after receiving the detection command issued by the computing control module, the wireless network card control unit first completes the network card mode configuration and channel scanning range. Then, the detection engine starts active detection in the channel polling mode, and at the same time starts passive listening mode to capture data synchronously. The data parsing unit parses the collected raw data in real time, extracts information such as the SSID, BSSID, channel number, signal strength, security protocol type and MAC address of the wireless access point, and requests relevant data. The parsed data is then uploaded to the computing control module and the local threat identification unit in real time.

[0028] If counterfeit access points or malicious hotspots appear in the information of wireless access points; Security protocols contain vulnerabilities that can be exploited or used for dimensionality reduction attacks. When one or more of the following occurs in the MAC address request: network reconnaissance or address spoofing, the WIFI detection module obtains terminal behavior data and application traffic statistics, and then parses them to obtain system data.

[0029] Among them, terminal behavior data is obtained by capturing authentication frames, association frames, and reconnection request frames between the terminal and the AP. Application traffic statistics are obtained by copying the communication traffic between the terminal and the network through traffic mirroring technology. Subsequently, the data parsing unit performs in-depth analysis on the collected secondary data to obtain system data.

[0030] Specifically, the WIFI detection module obtains current behavior data based on terminal behavior data and compares the current behavior data with the set behavior data through the behavior prediction model to obtain the difference value. If the difference value exceeds the indicator range, it is marked as the first system data. In specific operation, the WIFI detection module extracts current behavior data such as connection duration, channel switching frequency, number of authentication failures, and reconnection interval based on terminal behavior data. The current behavior data is compared with preset normal behavior data through a behavior prediction model, and the difference between the two is calculated. If the difference exceeds the preset index range, it is marked as the first system data. The WIFI detection module obtains metadata based on application traffic statistics. The metadata includes transport layer protocol type, source / destination port number, packet size, transmission direction and timestamp.

[0031] The extracted metadata is decoded and reassembled into a protocol, and multidimensional traffic features are constructed based on the reassembled session stream. The multidimensional traffic features include connection frequency per unit time, uplink and downlink traffic ratio, proportion of specific protocol data packets, and distribution pattern of data packet size. The multidimensional traffic characteristics are matched with the set multidimensional traffic, and the deviation from the normal behavior baseline is calculated. If a specific attack rule is matched or the deviation exceeds the preset threshold, it is marked as second system data.

[0032] In practice, the WIFI detection module extracts metadata from the application traffic statistics through the data parsing unit. The metadata includes the transport layer protocol type, source / destination port number, packet size, transmission direction, and timestamp. The data parsing unit uses protocol stack layer-by-layer decoding technology to decode the extracted metadata. Based on the five-tuple (source IP, destination IP, source port, destination port, protocol type), the discrete data packets are reassembled into a complete session stream using a session reassembly algorithm. Then, based on the reassembled session stream, multi-dimensional traffic features are constructed using feature engineering methods. These multi-dimensional traffic features include the connection frequency per unit time, the ratio of uplink to downlink traffic, the proportion of packets with specific protocols, and the distribution pattern of packet size. Subsequently, the constructed multi-dimensional traffic features are matched with a preset normal multi-dimensional traffic feature library. At the same time, the deviation from the normal behavior baseline is calculated using a deviation calculation algorithm. This normal behavior baseline is generated by training on traffic data from massive normal network scenarios. If a specific attack rule is matched or the deviation exceeds a preset threshold, it is marked as second system data.

[0033] The defense simulation module communicates with the computational control module. It has built-in indicator ranges for system data. If system data falls outside the corresponding range, it is marked as abnormal. The defense simulation module then performs a simulated counterattack operation based on the abnormal data. Specifically, after receiving system data synchronized from the computational control module, the data verification unit first verifies the data's integrity and validity. Then, the anomaly detection unit compares the verified data with the built-in indicator ranges. If the system data is outside the corresponding range, it is marked as abnormal. Subsequently, the anomaly detection unit sends the abnormal data classification information to the counterattack strategy execution unit, which matches the corresponding counterattack strategy and completes the simulated counterattack operation.

[0034] The defense simulation module includes a defense line submodule and a data isolation submodule. The defense line submodule integrates a boundary layer detection unit, an access layer detection unit, a data layer detection unit, and an inter-layer linkage unit. The boundary layer detection unit provides initial protection based on MAC address filtering and Beacon frame legitimacy verification. The access layer detection unit uses EAP authentication protocol integrity verification technology for deep verification. The data layer detection unit ensures data security through encrypted data packet hash value verification. The inter-layer linkage unit uses a trigger-based linkage mechanism to achieve coordinated detection across layers. The defense line submodule is used to set detection points at the wireless network boundary, access layer, and data layer to perform layered detection and graded response of system data. In specific operation, the boundary layer detection unit first verifies the MAC address and AP validity information in the system data. When abnormal data breaks through the first layer detection point, the inter-layer linkage unit immediately triggers the deep protocol analysis and behavior verification of the second layer access layer detection unit to verify the integrity of the terminal authentication process and the standardization of protocol interaction. If abnormal data breaks through the preset number of detection points continuously, the abnormal judgment unit will comprehensively determine it as abnormal data.

[0035] The data isolation submodule integrates a core data identification unit, an encrypted storage unit, a permission management unit, and an access control unit. The core data identification unit identifies core data through keyword matching and data feature extraction technology. The encrypted storage unit uses the AES-256 symmetric encryption algorithm to encrypt the core data. The permission management unit implements hierarchical access permissions based on the RBAC permission model. The access control unit integrates multiple authentication and operation auditing functions. The data isolation submodule is used to identify and mark the core data in the system data. The core data includes user authentication information, encryption keys, and management instructions. The core data is encrypted and stored, and access permissions are hierarchically defined and isolated in network areas.

[0036] In practice, the core data identification unit scans system data in real time, marks the identified core data, and transmits it to the encrypted storage unit for encryption. At the same time, the access control unit assigns corresponding core data access permissions to different user roles. VLAN segmentation is used to achieve network isolation between the core data storage area and the exercise area. When the access control unit detects an abnormal access request, it immediately initiates a multi-authentication process and performs operation auditing to record the access behavior. If the number of failed authentications exceeds the threshold, the data link of the request is immediately cut off and the corresponding core data access permissions are locked to prevent core data leakage.

[0037] The simulated counterattack operations performed by the defense simulation module include: Based on the data from the first system, the target wireless network is subjected to password cracking attacks, spoofing access point attacks, or denial-of-service attacks. The password cracking attack is based on an algorithm that combines dictionary attacks and brute-force attacks. It simulates the cracking by generating a password dictionary and attempting to authenticate with the target AP. The spoofing access point attack constructs a virtual spoofing AP by copying key information such as the SSID and BSSID of the legitimate AP. The denial-of-service attack is achieved by sending a large number of Deauthentication frames to occupy the channel resources of the target AP. The second system simulates malware behavior, wireless eavesdropping, man-in-the-middle attacks, and resource exhaustion attacks, and constructs device behavior profiles or monitors malicious traffic patterns. Malware behavior simulation is achieved by simulating the traffic transmission characteristics and terminal operation behavior of malware. Wireless eavesdropping is achieved by capturing and parsing the communication data of the target channel. Man-in-the-middle attacks are achieved by intercepting and forwarding the communication data between the terminal and the AP based on ARP spoofing technology. Resource exhaustion attacks are achieved by simulating a large number of terminals concurrently accessing the target AP and consuming its bandwidth and connection resources.

[0038] Furthermore, the construction of device behavior profiles includes: The MAC address request is parsed to obtain the device fingerprint information, which includes the device type, operating system, and network card manufacturer identifier. Feature extraction is performed on application traffic statistics using feature engineering algorithms. Key features such as connection frequency, access time distribution, protocol usage preference, and data packet length distribution are extracted from the traffic data. Connection frequency is obtained by counting the number of connections established per unit time. Access time distribution is obtained by statistically analyzing traffic data from different time periods. Protocol usage preference is determined by counting the usage ratio of each application layer protocol. Data packet length distribution is obtained by counting the number of data packets of different sizes. Based on device fingerprint information and feature extraction results, a baseline device behavior model is generated by training a large amount of normal device data using the K-means clustering algorithm. Risk weights are assigned to different feature dimensions based on the degree of impact of each feature on network security. The risk weights are determined by the analytic hierarchy process. The real-time collected system data is compared with the device baseline behavior model, and the behavior deviation is calculated using the cosine similarity algorithm. This algorithm characterizes the similarity between the real-time behavior feature vector and the baseline model feature vector by calculating the cosine value of the two. The smaller the cosine value, the greater the deviation. When the behavioral deviation exceeds a preset threshold, the device behavior profile is immediately updated and stored in the profile database. At the same time, it is marked as a suspicious device, and the counterattack strategy execution unit triggers the corresponding simulated attack operation. By simulating attack behavior against such suspicious devices, the effectiveness of the defense mechanism is verified.

[0039] The attack simulation module is connected to the computing control module via a dedicated wireless communication link. It has a built-in attack strategy parsing unit, attack engine, and status feedback unit. The attack strategy parsing unit is used to parse the attack commands issued by the computing control module. The attack engine integrates multiple attack technology implementation modules. The status feedback unit collects various status data during the attack process in real time and feeds them back to the computing control module. The attack simulation module is used to perform simulated attack operations on the wireless network in a specified area under the active control of the computing control module.

[0040] In practice, after receiving the attack command from the computing control module, the attack strategy parsing unit parses key information such as the attack target, attack type, and attack parameters. Then, the corresponding attack engine module is started to execute the simulated attack. The status feedback unit monitors the attack progress, attack effect, and its own running status in real time and feeds the relevant data back to the computing control module in real time. The attack parameters are adjusted or the attack is terminated according to the instructions of the computing control module.

[0041] The attack simulation module includes: The hotspot management unit is used to add fake Wi-Fi hotspots and manage virtual login users. Password cracking unit, used to perform WIFI password cracking operations; Signal jamming unit, used to generate jamming signals required for denial-of-service attacks; The protocol vulnerability exploitation unit is used to launch simulated attacks against known vulnerabilities in the WIFI communication protocol.

[0042] In a specific embodiment, the hotspot management unit is built based on hostapd virtual AP technology and includes a built-in hotspot configuration module and a virtual user management module. The hotspot configuration module allows for custom settings of hotspot parameters such as SSID, BSSID, channel, and security protocol. The virtual user management module generates virtual login users by simulating terminal access requests and supports setting parameters such as the number of virtual users and access frequency. It is used to add spoofed Wi-Fi hotspots and manage virtual login users. In specific operations, after receiving an attack command, the hotspot configuration module configures the relevant information of the spoofed Wi-Fi hotspot according to the command parameters and starts hotspot broadcasting. The virtual user management module generates virtual login users according to the set parameters, simulates the terminal access authentication process, and records the access status of the virtual users.

[0043] The password cracking unit integrates a dictionary attack module, a brute-force attack module, and a handshake packet capture module. The dictionary attack module has built-in password dictionaries for various scenarios and supports user-defined imported dictionaries. The brute-force attack module generates passwords by traversing a specified character set and attempts to crack them. The handshake packet capture module captures WPA / WPA2 protocol handshake packets by monitoring the authentication process between the terminal and the AP, and is used to perform Wi-Fi password cracking operations. Specifically, the handshake packet capture module first monitors the authentication channel of the target AP. When a terminal access is detected, it captures the handshake packet. Then, according to the attack command, it selects either a dictionary attack or brute-force attack mode, calls the corresponding module to crack the handshake packet, provides real-time feedback on the cracking progress during the cracking process, and records the cracked password upon successful cracking. The signal jamming unit is built based on radio frequency signal generation technology. It incorporates a signal generator and a power adjustment module. The signal generator produces jamming frames conforming to the IEEE 802.11 protocol, and the power adjustment module adjusts the transmission power of the jamming signal according to attack requirements. This is used to generate the jamming signal needed for a denial-of-service attack. In operation, after receiving an attack command, the channel and signal parameters of the jamming target are determined. The signal generator produces the corresponding jamming frame, and the power adjustment module starts transmitting the jamming signal at the set power. By continuously sending jamming frames, the target channel resources are occupied, blocking communication between the normal terminal and the access point (AP). The protocol vulnerability exploitation unit has a built-in WIFI protocol vulnerability library and integrates a vulnerability scanning module and an attack payload generation module. The vulnerability scanning module detects whether the target AP has known vulnerabilities by sending specific probe packets. The attack payload generation module generates corresponding attack payloads according to the exploitation principles of different vulnerabilities, which are used to launch simulated attacks against known vulnerabilities in the WIFI communication protocol. In specific operation, the vulnerability scanning module first performs vulnerability detection on the target AP. After identifying the existing exploitable vulnerabilities, the attack payload generation module generates the corresponding attack payload and sends it to the target AP through the network to trigger the vulnerability and realize the simulated attack. The attack simulation module performs the following simulated attack operations: The system performs proactive analysis and processing of data, including data cleaning, protocol parsing, and vulnerability feature matching. Data cleaning is achieved by removing invalid, duplicate, and noisy data, and data filtering algorithms are used to retain valid attack-related data. Protocol parsing is performed by parsing the network protocol stack layer by layer, extracting key protocol information from the data link layer to the application layer. Vulnerability feature matching is performed by comparing the parsed data with the built-in vulnerability feature library to identify potential vulnerability exploitation points. Based on the results of proactive analysis and processing, security vulnerabilities of the target wireless network are identified. These vulnerabilities include weak encryption algorithms, unpatched protocol vulnerabilities, and default configuration defects. Weak encryption algorithms are identified by identifying the encryption protocol version and encryption key length used. Unpatched protocol vulnerabilities are identified by vulnerability feature matching results. Default configuration defects are identified by detecting the default username and password of the AP, and the open default ports. The computational control module, based on the identified security vulnerabilities and combined with the built-in attack strategy generation algorithm, matches the corresponding attack methods, attack parameters, and attack processes to generate an attack strategy. It then actively triggers the attack simulation module to execute the corresponding simulated attack operations through the communication link. Simultaneously, it receives real-time status feedback data from the attack simulation module and dynamically adjusts the attack strategy based on the feedback data.

[0044] The embodiment also includes a visualization module and an antenna module. The visualization module establishes a real-time communication connection with the computing control module through the WebSocket protocol. It has a built-in data visualization engine, a topology map generation module, and a status monitoring module. The data visualization engine uses the ECharts visualization library to realize the chart display of data. The topology map generation module constructs the wireless network topology structure based on network detection data. The status monitoring module collects the operating status data of each module in real time, which is used to display the network information obtained by the WIFI detection unit, the attack process and status of the attack simulation unit, and the security status of the network in real time.

[0045] In specific operation, after receiving various types of data synchronized by the computing control module, the data visualization engine transforms network information, attack data, etc. into charts such as line charts, bar charts, and pie charts. The topology generation module constructs and dynamically updates the wireless network topology. The status monitoring module displays the operating status of each module in the form of indicator lights, progress bars, etc., and also supports user interaction to query detailed data. The antenna module is connected to the WIFI detection unit and / or attack simulation unit via an SMA interface. It adopts a high-gain directional antenna design and has a built-in power amplifier circuit and signal filtering module. The power amplifier circuit can enhance the transmission and reception power of the wireless signal, and the signal filtering module can filter interference signals to improve signal quality, thereby enhancing the reception and transmission power of the wireless signal.

[0046] In practice, the weak wireless signal received by the WIFI detection unit is amplified by the power amplifier circuit to improve the detection range and accuracy. At the same time, the attack signal emitted by the attack simulation unit is amplified to enhance the coverage and penetration of the attack signal. The signal filtering module filters out interference signals in the environment to ensure the stability and reliability of signal transmission.

[0047] The present invention also provides a method for demonstrating network security attack and defense based on WIFI, using any of the systems described above for demonstrating network security attack and defense based on WIFI.

[0048] Example 1

[0049] The smart campus network security training scenario is designed to provide practical training in WIFI attack and defense techniques for computer science students in universities. The training area covers the public WIFI area of ​​the campus library, multimedia classrooms in teaching buildings, and the training center. The scenario not only has the complex environmental characteristics of a real public wireless network, but also avoids the impact of the drills on the normal teaching network through campus network isolation technology.

[0050] In terms of hardware deployment, the computing control module uses an industrial-grade server (configured with an Intel Xeon E5 processor, 32GB of memory, and a 1TB SSD) deployed in the training center's computer room. It runs Ubuntu 22.04 and a self-developed attack and defense training platform, connected to the campus network's core switch via Gigabit Ethernet, and configured with a fixed IP address of 192.168.10.100 for inter-module communication. The WIFI detection module and attack simulation module use portable embedded devices (equipped with an ARM Cortex-A72 processor) with built-in dual-band wireless network cards (supporting 802.11a / b / g / n / ac). They are deployed at three training locations: the third-floor reading area of ​​the library and classroom 201 of the teaching building. Each device establishes an encrypted communication link with the computing control module via TCP / IP protocol, with the communication port set to 8080 and SSL encryption enabled. The antenna module uses an 8dBi high-gain directional antenna, connected to the detection and attack modules via an SMA interface. The antenna angle is adjusted according to the training locations to ensure a signal coverage radius of no less than 50 meters, meeting the needs of simultaneous multi-terminal training. The visualization module uses a 55-inch touch screen and is deployed at the front of the training classroom. It is linked with the computing control module in real time via the WebSocket protocol.

[0051] In terms of software configuration, the computing control module loads a campus-specific attack and defense strategy template, presets the fake hotspot SSID as "Campus-WIFI-Test" (simulating the official campus hotspot), configures 100 virtual users (simulating teacher and student terminals), and adds scenario-based strategies such as "campus network weak password cracking" and "teaching building AP protocol downgrade attack" to the attack strategy library. The WIFI detection module sets the detection channels to the commonly used campus channels 1, 6, 11 (2.4G) and 36, 40 (5G), and adjusts the behavior prediction model threshold to 0.7 to adapt to the campus scenario (difference values ​​exceeding 0.7 are marked as abnormal). The multi-dimensional traffic feature library imports normal campus internet traffic samples (including traffic features from online classes, literature searches, and other applications). The defense simulation module's defense line submodule sets three layers of detection trigger thresholds, imports the MAC address filtering rules of the boundary layer into the campus's legitimate terminal MAC whitelist, sets the access layer EAP authentication timeout to three seconds, and the data layer's encrypted data packet hash verification fault tolerance rate is 0.01%. The data isolation submodule marks student IDs, campus card payment information, etc., as core data, uses AES-256 encryption for storage, and has access permissions divided into two levels: teacher and student.

[0052] The operational process is as follows: After the training begins, the computing control module issues a detection command, and the detection modules at each location simultaneously scan the surrounding Wi-Fi networks, capturing information from official campus access points (APs) and simulated malicious APs. When a hotspot spoofing "Campus-WIFI-Test" is detected, secondary data collection is triggered to extract terminal connection behavior and online class traffic data. After the defense module marks abnormal data, it triggers a counterattack by blocking the spoofed APs, and the attack module simultaneously performs WPA2 password dictionary cracking (the dictionary contains commonly used weak passwords on campus, such as "student ID + birthday"). The visualization module displays the network topology, attack progress, and defense response status in real time, and teachers can adjust attack parameters via a touchscreen. The entire training process is implemented through the campus network's isolated VLAN, without affecting the normal operation of the teaching network. The training data is stored in real time to the computing control module for post-training review and analysis.

[0053] The above descriptions are merely embodiments of the present invention, and common knowledge regarding specific structures and characteristics is not elaborated upon here. It should be noted that those skilled in the art can make various modifications and improvements without departing from the structure of the present invention, and these should also be considered within the scope of protection of the present invention. These modifications and improvements will not affect the effectiveness of the present invention or the practicality of the patent. The scope of protection claimed in this application should be determined by the content of its claims, and the specific embodiments described in the specification can be used to interpret the content of the claims.

Claims

1. A system for demonstrating network security attack and defense based on WIFI, characterized in that: include The computing control module is a platform for running attack and defense exercises, used to centrally control and schedule the entire system's attack and defense demonstration process. A WIFI detection module, which is communicatively connected to the computing control module, is used to actively detect and passively listen to the wireless network in a designated area under the control of the computing control module to obtain information about wireless access points, security protocols, and MAC address requests. If counterfeit access points or malicious hotspots appear in the information of wireless access points; Security protocols contain vulnerabilities that can be exploited or used for dimensionality reduction attacks. When one or more of network reconnaissance and address spoofing occur in the MAC address request, the WIFI detection module obtains terminal behavior data and application traffic statistics information and parses them to obtain system data. The defense simulation module is communicatively connected to the computing control module. The defense simulation module has a built-in index range for the system data. If the system data is not within the corresponding range value, it is marked as abnormal data. The defense simulation module performs corresponding simulated counterattack operations based on the abnormal data. An attack simulation module, which is communicatively connected to the computing control module, is used to perform simulated attack operations on a wireless network in a specified area under the active control of the computing control module.

2. The system for demonstrating network security attack and defense based on WIFI according to claim 1, characterized in that: The WIFI detection module obtains current behavior data based on the terminal behavior data and compares the current behavior data with the set behavior data through the behavior prediction model to obtain the difference value. If the difference value exceeds the index range, it is marked as the first system data. The WIFI detection module obtains metadata based on application traffic statistics, including transport layer protocol type, source / destination port number, data packet size, transmission direction and timestamp. The extracted metadata is subjected to protocol decoding and session reassembly, and multi-dimensional traffic features are constructed based on the reassembled session stream. The multi-dimensional traffic features include connection frequency per unit time, uplink and downlink traffic ratio, proportion of specific protocol data packets, and distribution pattern of data packet size. The multidimensional traffic features are matched with the set multidimensional traffic, and the deviation from the normal behavior baseline is calculated. If a specific attack rule is matched or the deviation exceeds a preset threshold, it is marked as second system data.

3. The system for demonstrating network security attack and defense based on WIFI according to claim 1, characterized in that, The defense simulation module includes: The defense submodule is used to set up detection points at the wireless network boundary, access layer and data layer respectively, and to perform layered detection and graded response on the system data. When abnormal data breaks through the first layer detection point, it triggers the deep protocol analysis and behavior verification of the second layer detection point. If it breaks through the preset number of detection points consecutively, it is determined to be abnormal data. The data isolation submodule is used to identify and mark the core data in the system data. The core data includes user authentication information, encryption keys and management instructions. The core data is stored in encryption, access permissions are graded and network areas are isolated. When an abnormal access request is detected, multiple authentication and operation audits are performed. If the number of authentication failures exceeds the threshold, the data link of the request is cut off and the corresponding core data access permissions are locked.

4. The system for demonstrating network security attack and defense based on WIFI according to claim 2, characterized in that, The simulated counterattack operations performed by the defense simulation module include: Based on the data from the first system, perform password cracking attacks, spoofed access point attacks, or denial-of-service attacks on the target wireless network. Based on the data from the second system, simulate malware behavior, wireless eavesdropping and man-in-the-middle attacks or resource exhaustion attacks, and build device behavior profiles or monitor malicious traffic patterns.

5. The system for demonstrating network security attack and defense based on WIFI according to claim 4, characterized in that, The device behavior profile construction includes: The MAC address request is parsed to obtain device fingerprint information, which includes device type, operating system, and network card manufacturer identifier. Feature extraction is performed on the application traffic statistics, including connection frequency, access time distribution, protocol usage preference, and data packet length distribution. Based on the device fingerprint information and the feature extraction results, a device baseline behavior model is generated through a clustering algorithm, and risk weights are assigned to different feature dimensions. The real-time collected system data is compared with the device baseline behavior model to calculate the behavior deviation. When the behavioral deviation exceeds a preset threshold, the device behavior profile is updated, stored, and marked as a suspicious device, triggering a corresponding simulated attack operation.

6. The system for demonstrating network security attack and defense based on WIFI according to claim 1, characterized in that, The attack simulation module includes: The hotspot management unit is used to add fake Wi-Fi hotspots and manage virtual login users. Password cracking unit, used to perform WIFI password cracking operations; Signal jamming unit, used to generate jamming signals required for denial-of-service attacks; The protocol vulnerability exploitation unit is used to launch simulated attacks against known vulnerabilities in the WIFI communication protocol.

7. The system for demonstrating network security attack and defense based on WIFI according to claim 1, characterized in that, The simulated attack operations performed by the attack simulation module include: The system data is actively analyzed and processed, including data cleaning, protocol parsing, and vulnerability feature matching. Based on the results of the active analysis and processing, security vulnerabilities of the target wireless network are identified, including weak encryption algorithms, unpatched protocol vulnerabilities, and default configuration defects. The computational control module generates an attack strategy based on the identified security vulnerabilities and actively triggers the attack simulation module to execute the corresponding simulated attack operations.

8. The system for demonstrating network security attack and defense based on WIFI according to claim 1, characterized in that: It also includes a visualization module and an antenna module. The visualization module is communicatively connected to the computing control module and is used to display in real time the network information obtained by the WIFI detection unit, the attack process and status of the attack simulation unit, and the security status of the network. The antenna module is connected to the WIFI detection unit and / or the attack simulation unit to enhance the reception and transmission power of wireless signals.

9. A method for demonstrating network security attack and defense based on WIFI, characterized in that, Use the system for demonstrating network security attack and defense based on WIFI as described in any one of claims 1-8.

Images