Wireless network adaptive scanning method and system based on WIFI sniffing technology

Abstract

The invention discloses a wireless network adaptive scanning method and system based on a WIFI sniffing technology, and belongs to the field of wireless network scanning. The method comprises the following steps: establishing a channel list supported by a wireless network card by using a WIFI probe, allocating resources and initializing a channel data structure; scanning and controlling a working channel and residence time of the WIFI probe in sequence according to a channel list supported by the wireless network card, realizing acquisition of wireless signals in a channel space, capturing 802.11 protocol data, and updating a channel data structure; classifying and analyzing the captured 802.11 protocol data, determining equipment and parameters thereof in the wireless network, and obtaining an activity characteristic statistical conclusion of the wireless network; according to channel scanning and the activity characteristic statistical conclusion of the wireless network, the channel scanning priority, the residence time and the timeout time are automatically adjusted, the parameters are used for the next round of channel scanning, the scanning strategy is optimized in real time, and the wireless network scanning performance is improved.

Description

Technical Field

[0001] This invention belongs to the field of wireless network scanning, specifically relating to an adaptive scanning method and system for wireless networks based on WIFI sniffing technology. Background Technology

[0002] WiFi probe technology is a technique that collects relevant information by listening to signals emitted by surrounding wireless devices. It primarily obtains identifying information such as the MAC address of a device by capturing probe request frames broadcast by that device. It is mainly used in areas such as commercial marketing, customer flow analysis, and public safety. The advantages of this technology are also obvious, mainly reflected in its non-intrusive data collection, passive monitoring, and wide coverage.

[0003] The performance and real-time limitations of Wi-Fi sniffing technology, especially the 802.11 monitoring mode, are well-known, involving factors such as hardware, drivers, software, configuration, and architecture. A crucial aspect of these hardware and software factors is channel switching overhead. Wi-Fi 6, corresponding to the 802.11ax standard and released in 2019, covers over 40 channels. The upcoming Wi-Fi 7, with its even higher frequency coverage, will significantly increase the number of available channels, potentially more than doubling the number of channels compared to Wi-Fi 6.

[0004] In the field of public safety, real-time monitoring of WIFI signals, network optimization, protection of key areas, and identification of abnormal behavior require high-performance scanning strategies and mechanisms to achieve a shift from passive monitoring to proactive early warning. Therefore, improving the scanning performance of wireless networks through technical means has positive social significance. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the present invention aims to provide a wireless network adaptive scanning method and system based on WIFI sniffing technology, thereby solving the problems in the prior art.

[0006] The objective of this invention can be achieved through the following technical solutions: An adaptive scanning method for wireless networks based on WIFI sniffing technology includes the following steps: Using a WIFI probe, establish a list of channels supported by the wireless network card, allocate resources, and initialize the channel data structure; Scan the list of channels supported by the wireless network card in order, control the working channel and dwell time of the WIFI probe, realize the acquisition of wireless signals in the channel space, capture 802.11 protocol data, and update the channel data structure. The captured 802.11 protocol data is classified and analyzed to identify the devices and their parameters in the wireless network, and statistical conclusions on the activity characteristics of the wireless network are obtained. Based on the statistical conclusions of channel scanning and wireless network activity characteristics, the channel scanning priority, dwell time, and timeout are automatically adjusted, and these parameters are used in the next round of channel scanning to optimize the scanning strategy in real time.

[0007] Furthermore, the WIFI probe is a wireless network card that supports a monitoring working mode. It is a passive probe used to detect, collect, and analyze WIFI signals. The WIFI probe operates in 2.4GHz and 5.8GHz frequency bands, supports IEEE802.11 a / b / g / n / ac / ax protocols, and enters monitoring mode after the USB is powered on.

[0008] Furthermore, the channel data structure includes: channel number, priority, activity status, number of access points, number of terminals, number of protocol packets, dwell time, and timeout.

[0009] Furthermore, the 802.11 protocol data includes: management frame, data frame, and control frame type data.

[0010] Furthermore, the activity characteristic statistical conclusions include: access point (AP) and its associated STA terminal information, as well as key statistical indicators; the key statistical indicators include the number of protocol packets.

[0011] Furthermore, the process of automatically adjusting scan priority, dwell time, and timeout includes: 1) After a complete scan cycle, count the number of protocol packets for all channels and re-prioritize the channels; for channels with 0 protocol packets, set them to low priority; for channels with more than 0 protocol packets, sort them in descending order of protocol packet count and divide them into high and medium priorities. 2) Once the priority is determined, adjust the dwell time and timeout time accordingly: High priority: dwell time 200ms, timeout 400ms; Medium priority: dwell time 100ms, timeout 200ms; Low priority: dwell time 50ms, timeout 100ms.

[0012] A wireless network adaptive scanning system based on WIFI sniffing technology, capable of executing the above-mentioned adaptive scanning method, includes: Initialization module: Using the WIFI probe, establish a list of channels supported by the wireless network card, allocate resources, and initialize the channel data structure; Data acquisition module: Scans the list of channels supported by the wireless network card in sequence, controls the working channel and dwell time of the WIFI probe, realizes the acquisition of wireless signals in the channel space, captures 802.11 protocol data, and updates the channel data structure. Data analysis module: Classifies and analyzes the captured 802.11 protocol data, identifies the devices and their parameters in the wireless network, and obtains statistical conclusions on the activity characteristics of the wireless network; Optimized scanning module: Based on channel scanning and statistical conclusions of wireless network activity characteristics, it automatically adjusts channel scanning priority, dwell time, and timeout, and uses these parameters for the next round of channel scanning, thus optimizing the scanning strategy in real time.

[0013] A computer storage medium storing a readable program, which, when executed, instructs a computing device to perform a wireless network adaptive scanning method based on WIFI sniffing technology as described above.

[0014] An electronic device includes: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; The memory is used to store at least one executable instruction, which causes the processor to perform an operation corresponding to the wireless network adaptive scanning method based on WIFI sniffing technology described above.

[0015] A computer program product includes computer instructions that instruct a computing device to perform operations corresponding to the wireless network adaptive scanning method based on WIFI sniffing technology described above.

[0016] The beneficial effects of this invention are: 1. This invention utilizes a wireless network card to listen to and capture data transmitted in a wireless network. Based on the 802.11 protocol and frame structure definition, it identifies access points and terminals and their relationship, statistically analyzes channel occupancy and network activity in the tested location, adjusts channel scanning priority and dwell time, optimizes scanning strategies in real time, and improves wireless network scanning performance. It provides timely and reliable decision-making basis for wireless network monitoring, network optimization, and abnormal behavior analysis.

[0017] 2. This invention achieves continuous tracking and scanning of hidden WIFI access points by adjusting the dwell time during wireless network scanning, analyzes and draws spatial network profiles, and provides data support for network security.

[0018] 3. This invention can provide a long-term and efficient solution for WIFI security checks in important locations, and combined with a blacklist and whitelist mechanism, it can provide timely warnings and ensure wireless network security. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the wireless network channel scanning structure of the present invention; Figure 2 This is a flowchart of the wireless network adaptive scanning process of the present invention; Figure 3 This is a diagram illustrating the adaptive scanning effect of the wireless network according to the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Example 1 like Figure 2 As shown, an adaptive scanning method for wireless networks based on WIFI sniffing technology includes the following steps: S1, using a WIFI probe, establishes a list of channels supported by the wireless network card, allocates resources, and initializes the channel data structure; In this embodiment, the WIFI probe is a passive probe that supports monitor mode; it is used to detect, collect, and analyze WIFI signals. The WIFI probe hardware includes: a USB 2.0 power supply and communication unit, a wireless network card unit, and an antenna unit. The USB 2.0 power supply and communication unit provides +5VDC power to the probe via a USB interface and also provides a communication channel for the network card to interact with the system; the wireless network card unit is a network card controller. The WIFI probe operates on 2.4GHz and 5.8GHz frequency bands and supports IEEE802.11 a / b / g / n / ac / ax protocols; it enters monitoring mode after USB power-on.

[0023] The channel data structure `chnlProperty` includes parameters such as: channel number (`chnlID`), priority, active status, number of access points (`apCount`), number of terminals (`staCount`), number of protocol packets (`protocolPackages`), dwell time (`dwellTime`), and timeout. The specific definitions are as follows: struct { uint8_t chnlID; / / Channel number uint8_t priority; / / Priority (three levels: 1 - high, 2 - medium, 3 - low) bool active; / / Active state int apCount; / / Number of access points int staCount; / / Number of terminals uint16_t protocolPackages; / / Number of protocol packets uint16_t avgPduSize; / / Average traffic int failureCount; / / Number of failures detected int dwellTime; / / Dwell time (corresponding to priority) int timeout; / / Timeout period (dwellTime) 2) } chnlProperty.

[0024] S2 scans the list of channels supported by the wireless network card in order, controls the working channel and dwell time of the WIFI probe, realizes the acquisition of wireless signals in the channel space, captures 802.11 protocol data, and updates the channel data structure (mainly the number of protocol packets). Scanning is performed based on the priority, dwell time, and timeout time in the channel list. Dwell time and timeout time determine the network scanning performance across the entire operating frequency band. The 802.11 protocol data of the wireless network captured during channel scanning mainly includes: management frames, data frames, and control frame type data.

[0025] The 802.11 protocol data is filtered and selected by binding the wireless network card and setting the filter string "type mgt or type data".

[0026] S3. Classify and analyze the captured 802.11 protocol data to identify the devices and their parameters in the wireless network, and obtain statistical conclusions on the activity characteristics of the wireless network, including: access point (AP) and its associated STA terminal information, as well as key statistical indicators. Management frames, data frames, and control frames reflect the current activity characteristics of the wireless network. Further subframe analysis based on these three types of frames reveals network device uplink and downlink paths, network device parameters and status, data traffic information, and analyzes network device relationships. Based on the captured data, access point (AP) and associated STA terminal information can be extracted. Key statistical indicators: The analysis results are used to update and adjust the channel data structure attributes, the most critical of which is to count the number of protocol packets captured by the channel in one period.

[0027] Specifically, the steps for classifying and analyzing 802.11 protocol data include: S31, the captured data is classified according to the 802.11 MAC frame format. The 802.11 MAC frame mainly consists of three parts: MacHeader, Frame Body, and FCS. The frame format is defined as follows: The Frame Control field is defined as follows: Data is categorized into three types—management frames, data frames, and control frames—by extracting the Type bit information from the Frame Control. The Type field bit definitions are shown in Table 1 below. Table 1. Definition of the Type bit in the Frame Control field of the 802.11 protocol frame S32, after classifying the frame categories, further analysis is performed on the Sub-Types in Frame Control to clarify the communication behavior and process between the AP and STA. Management frames are mainly used for negotiation and connection control between the STA and AP, such as association, authentication, and synchronization. Sub-Types further determine the frame type; for example, management frames are subdivided into association and authentication frames, as detailed in Table 2 below. Table 2. Correspondence between Type and Sub Type fields in the 802.11 protocol frame control field. Through the above classification and analysis, a list of AP and STA devices within each channel of each wireless network environment can be established and associated, and other relevant channel parameter information can be updated synchronously, such as... Figure 1 As shown.

[0028] S4 automatically adjusts the channel scanning priority, dwell time, and timeout based on channel scanning and statistical conclusions of wireless network activity characteristics, and uses these parameters for the next round of channel scanning, thereby optimizing the scanning strategy in real time.

[0029] Based on the protocol data analysis results, the channel data structure attributes are updated and adjusted. The scanning strategy is defined as follows: 1) After a complete scan cycle, the number of protocol packets for all channels is counted, and the channel priorities are re-divided. The priority levels are shown in Table 3 below: Table 3. Channel packet traffic priority definition Channels with a protocol packet count greater than zero (indicating network activity) are sorted in descending order and divided into high and medium priorities; channels without network activity are uniformly set to low priority.

[0030] 2) After the priority is determined, adjust the dwell time and timeout time according to Table 4, and start scanning again.

[0031] Table 4. Definitions of Channel Scan Dwell Time and Timeout Based on a similar inventive concept, this embodiment of the invention also provides a computer storage medium storing a readable program that, when run by a processor, can execute the aforementioned adaptive scanning method for wireless networks based on WIFI sniffing technology.

[0032] Based on a similar inventive concept, this invention provides an electronic device, including: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the above-described adaptive scanning method for wireless networks based on WIFI sniffing technology.

[0033] Based on a similar inventive concept, embodiments of the present invention also provide a computer program product, including computer instructions, which instruct a computing device to perform the operations corresponding to the above-described adaptive scanning method for wireless networks based on WIFI sniffing technology.

[0034] The principle of this invention: By utilizing a wireless network card to listen for and capture data transmitted over a wireless network, and based on the 802.11 protocol and frame structure definition, the system identifies access points and terminals, as well as their relationships. It statistically analyzes channel occupancy and network activity at the tested location, adjusts channel scanning priority and dwell time, and optimizes scanning strategies in real time to improve wireless network scanning performance. Wireless network cards support numerous channels, usually sufficient to cover the wireless network channels at the tested location. However, many channels will have no network activity during the entire scanning cycle, resulting in excessively long scanning cycles for these inactive channels, significantly reducing time efficiency. Performing the same level of scanning on all channels severely degrades real-time performance. Adjusting the scanning strategy allows for timely tracking of network activity spikes and sudden network anomalies.

[0035] Example 2 Based on the adaptive wireless network scanning method based on WIFI sniffing technology proposed in Embodiment 1, this embodiment proposes an adaptive wireless network scanning system based on WIFI sniffing technology, specifically including: Initialization module: Using the WIFI probe, establish a list of channels supported by the wireless network card, allocate resources, and initialize the channel data structure; Data acquisition module: Scans the list of channels supported by the wireless network card in sequence, controls the working channel and dwell time of the WIFI probe, realizes the acquisition of wireless signals in the channel space, captures 802.11 protocol data, and updates the channel data structure. Data Analysis Module: Classifies and analyzes the captured 802.11 protocol data, identifies the devices and their parameters in the wireless network, and obtains statistical conclusions on the activity characteristics of the wireless network, including: access point (AP) and its associated STA terminal information, as well as key statistical indicators; Optimized scanning module: Based on channel scanning and statistical conclusions of wireless network activity characteristics, it automatically adjusts channel scanning priority, dwell time, and timeout, and uses these parameters for the next round of channel scanning, thus optimizing the scanning strategy in real time.

[0036] Example 3 In this embodiment, a specific example is used to verify the scanning method of the present invention; The verification process is as follows; 1) Set up two dual-band wireless routers, one of which is connected to the Internet (A1), and the other is not connected to the Internet (A2). 2) Prepare two mobile phones, one with an Android system (P1) and the other with an iOS system (P2). Both mobile phones are connected to access point A1. 3) Start scanning the channel. Wireless network A1 has a faster scan update cycle, while network A2 has a relatively longer update cycle. 4) Access point A2 is connected to the Internet, and two mobile phones are simultaneously switched to connect to the same network; 5) After scanning for a period of time, the update cycle of wireless network A2 is faster, while the update cycle of network A1 becomes slower.

[0037] Scanning results as follows Figure 3 As shown, for access points with no network activity, the scanning time is essentially the timeout period; for access points with network activity, the scanning time is essentially the dwell time; changes in the access point's operating channel are also promptly reported; the scanning cycle for all channels in both the 2.4GHz and 5.8GHz dual-band systems can be controlled within 90 seconds, and the monitoring terminal can update access point and associated terminal information at the millisecond level. By setting and optimizing the channel dwell and timeout intervals, the system's scanning rate can be increased, basically meeting the monitoring needs of important locations for regional wireless networks.

[0038] The methods of the present invention can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code originally stored on a remote recording medium or a non-transitory machine-readable medium and subsequently stored on a local recording medium, downloaded via a network. Thus, the methods described herein can be processed by software stored on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an ASIC or FPGA). It is understood that the computer, processor, microprocessor controller, or programmable hardware includes storage components (e.g., RAM, ROM, flash memory, etc.) capable of storing or receiving software or computer code that, when accessed and executed by the computer, processor, or hardware, implements the methods described herein. Furthermore, when a general-purpose computer accesses the code used to implement the methods shown herein, the execution of the code transforms the general-purpose computer into a dedicated computer for performing the methods shown herein.

[0039] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention.

Claims

1. A wireless network adaptive scanning method based on WIFI sniffing technology, characterized in that, Includes the following steps: Using a WIFI probe, establish a list of channels supported by the wireless network card, allocate resources, and initialize the channel data structure; Scan the list of channels supported by the wireless network card in order, control the working channel and dwell time of the WIFI probe, realize the acquisition of wireless signals in the channel space, capture 802.11 protocol data, and update the channel data structure. The captured 802.11 protocol data is classified and analyzed to identify the devices and their parameters in the wireless network, and statistical conclusions on the activity characteristics of the wireless network are obtained. Based on the statistical conclusions of channel scanning and wireless network activity characteristics, the channel scanning priority, dwell time, and timeout are automatically adjusted, and these parameters are used in the next round of channel scanning to optimize the scanning strategy in real time.

2. The adaptive scanning method for wireless networks based on WIFI sniffing technology according to claim 1, characterized in that, The WIFI probe is a wireless network card that supports monitoring mode. It is a passive probe used to detect, collect, and analyze WIFI signals. The WIFI probe operates in 2.4GHz and 5.8GHz frequency bands, supports IEEE802.11 a / b / g / n / ac / ax protocols, and enters monitoring mode after USB power-on.

3. The adaptive scanning method for wireless networks based on WIFI sniffing technology according to claim 1, characterized in that, The channel data structure includes: channel number, priority, activity status, number of access points, number of terminals, number of protocol packets, dwell time, and timeout.

4. The adaptive scanning method for wireless networks based on WIFI sniffing technology according to claim 1, characterized in that, The 802.11 protocol data includes: management frame, data frame, and control frame type data.

5. The adaptive scanning method for wireless networks based on WIFI sniffing technology according to claim 1, characterized in that, The activity feature statistics include: access point (AP) and its associated STA terminal information, as well as key statistical indicators; the key statistical indicators include the number of protocol packets.

6. The adaptive scanning method for wireless networks based on WIFI sniffing technology according to claim 1, characterized in that, The process of automatically adjusting scan priority, dwell time, and timeout includes: 1) After a complete scan cycle, count the number of protocol packets for all channels and re-prioritize the channels; for channels with 0 protocol packets, set them to low priority; for channels with more than 0 protocol packets, sort them in descending order of protocol packet count and divide them into high and medium priorities. 2) Once the priority is determined, adjust the dwell time and timeout time accordingly: High priority: dwell time 200ms, timeout 400ms; Medium priority: dwell time 100ms, timeout 200ms; Low priority: dwell time 50ms, timeout 100ms.

7. A wireless network adaptive scanning system based on WIFI sniffing technology, capable of executing the adaptive scanning method according to any one of claims 1-6, characterized in that, include: Initialization module: Using the WIFI probe, establish a list of channels supported by the wireless network card, allocate resources, and initialize the channel data structure; Data acquisition module: Scans the list of channels supported by the wireless network card in sequence, controls the working channel and dwell time of the WIFI probe, realizes the acquisition of wireless signals in the channel space, captures 802.11 protocol data, and updates the channel data structure. Data analysis module: Classifies and analyzes the captured 802.11 protocol data, identifies the devices and their parameters in the wireless network, and obtains statistical conclusions on the activity characteristics of the wireless network; Optimized scanning module: Based on channel scanning and statistical conclusions of wireless network activity characteristics, it automatically adjusts channel scanning priority, dwell time, and timeout, and uses these parameters for the next round of channel scanning, thus optimizing the scanning strategy in real time.

8. A computer storage medium storing a readable program, characterized in that, When the program runs, it can instruct the computing device to perform a wireless network adaptive scanning method based on WIFI sniffing technology as described in any one of claims 1-6.

9. An electronic device, characterized in that, include: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the wireless network adaptive scanning method based on WIFI sniffing technology as described in any one of claims 1-6.

10. A computer program product comprising computer instructions, characterized in that, The computer instructions instruct the computing device to perform the operation corresponding to the wireless network adaptive scanning method based on WIFI sniffing technology as described in any one of claims 1-6.

Images