Method, device and computer readable storage medium for detecting ap attacks

Abstract

The application relates to the technical field of communication, in particular to an AP attack detection method, an AP attack detection device and a computer readable storage medium. The method comprises the following steps: receiving a target wireless frame from a target wireless access point (AP), wherein the target wireless frame comprises a target service set identifier (SSID); performing visual feature extraction on the target SSID after image processing to obtain target visual feature information of the target SSID; if the similarity between the target visual feature information of the target SSID and the visual feature information of any SSID in a legal SSID set is greater than or equal to a preset threshold, it is determined that the target AP is an attack AP, wherein the visual feature information of any SSID in the legal SSID set is obtained by performing visual feature extraction on the SSID after image processing. According to the technical scheme provided by the application, visually similar SSIDs can be accurately identified, and an AP with visual attack can be detected.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to AP attack detection methods, apparatus and computer-readable storage media. Background Technology

[0002] Phishing access point (AP) attacks are among the most common and highly dangerous types of malicious network attacks. Attackers typically deploy one or more fake APs with SSIDs (Service Set Identifiers, i.e., Wi-Fi names) that are highly similar to or identical to legitimate APs within the coverage area of ​​a legitimate corporate or public wireless network. This is used to trick employees or users into connecting to the fake APs, thereby launching a man-in-the-middle attack and stealing sensitive user account passwords or internal corporate data.

[0003] Currently, when performing phishing detection on access points (APs), Wireless Intrusion Prevention Systems (WIPS) can calculate the text similarity between the SSID and the SSID in the legitimate whitelist based on string edit distance.

[0004] However, since the string edit distance is calculated using an absolute counting method, attackers can easily change the string length of the SSID, making it impossible for WIPS to detect illegal SSIDs. Summary of the Invention

[0005] This application provides an AP attack detection method, apparatus, and computer-readable storage medium to address the problem of low accuracy in detecting illegal SSIDs in the prior art.

[0006] In a first aspect, this application provides an AP attack detection method, applied to a wireless intrusion prevention system. The method includes: receiving a target wireless frame from a target wireless access point (AP), the target wireless frame including a target service set identifier (SSID); performing visual feature extraction on the target SSID after image processing to obtain target visual feature information of the target SSID; if the similarity between the target visual feature information of the target SSID and the visual feature information of any SSID in the set of legitimate SSIDs is greater than or equal to a preset threshold, then determining that the target AP is an attacking AP, wherein the visual feature information of any SSID in the set of legitimate SSIDs is obtained by performing visual feature extraction on the image processing of the SSID.

[0007] Secondly, embodiments of this application provide an AP attack detection device, which is applied to a wireless intrusion prevention system and includes: Frame receiving module, used to receive target wireless frames from target wireless access point AP, the target wireless frames including target service set identifier (SSID); The feature extraction module is used to extract visual features from the target SSID after image processing to obtain the target visual feature information of the target SSID; The attack identification module is used to determine that the target AP is an attack AP if the similarity between the target visual feature information of the target SSID and the visual feature information of any SSID in the set of legitimate SSIDs is greater than or equal to a preset threshold. The visual feature information of any SSID in the set of legitimate SSIDs is obtained by visual feature extraction after image processing of the SSID.

[0008] Thirdly, embodiments of this application provide an AP attack detection device, which includes: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of the first aspects above, according to the obtained program instructions.

[0009] Fourthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing a computer to perform the steps of the method as described in any of the first aspects above.

[0010] In summary, the AP attack detection method provided in this application first receives a target wireless frame from a target wireless access point (AP), the target wireless frame including a target service set identifier (SSID); then, the target SSID is image-processed and visual features are extracted to obtain target visual feature information of the target SSID; subsequently, if the similarity between the target visual feature information of the target SSID and the visual feature information of any SSID in the set of legitimate SSIDs is greater than or equal to a preset threshold, then the target AP is determined to be an attack AP, wherein the visual feature information of any SSID in the set of legitimate SSIDs is obtained by image-processing the SSID and then extracting its visual features.

[0011] The AP attack detection method provided in this application involves processing the SSID in a wireless frame from a target AP with an image and extracting its visual features to obtain the visual feature information of the SSID. The similarity between the visual feature information of the SSID and the visual feature information of any SSID in the set of legitimate SSIDs is then compared. If the similarity is higher than a preset threshold, the target AP is determined to be an attacking AP. This method can more accurately identify visually similar SSIDs and detect APs that are subject to visual attacks. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments of this application or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings of the embodiments of this application.

[0013] Figure 1 A flowchart illustrating an AP attack detection method provided in an embodiment of this application; Figure 2 for Figure 1 A flowchart illustrating step 110; Figure 3 This is a schematic diagram of the structure of an AP attack detection device provided in an embodiment of this application; Figure 4 This is a schematic diagram of another AP attack detection device provided in an embodiment of this application. Detailed Implementation

[0014] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “the,” and “the” as used in this application and claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to any and all possible combinations comprising one or more of the associated listed items.

[0015] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" may also be interpreted as "when," "when," or "in response to a determination."

[0016] Among various attack methods, "phishing AP attacks" (or "evil twin attacks") are among the most common and extremely harmful. Attackers typically deploy one or more fake APs with SSIDs (Service Set Identifiers, i.e., Wi-Fi names) that are highly similar to or identical to legitimate APs within the coverage area of ​​a legitimate corporate or public wireless network. This is used to trick employees or users into connecting to the network, thereby launching a man-in-the-middle attack and stealing sensitive user account passwords or internal corporate data.

[0017] To prevent such threats, Wireless Intrusion Prevention Systems (WIPS) have emerged. WIPS systems use wireless sensors deployed in space to continuously monitor beacon frames and probe response frames over the air interface, analyzing the SSIDs they carry to determine if phishing attacks are targeting legitimate corporate Wi-Fi networks.

[0018] Currently, existing WIPS systems calculate the text similarity between the unknown SSID and each legitimate SSID in the whitelist of legitimate SSIDs when detecting phishing attacks on unknown access points (APs). The text similarity calculation mainly relies on string edit distance algorithms based on literal matching (such as the Levenshtein Distance algorithm) or the Jaro-Winkler algorithm based on fixed prefix matching. A high text similarity indicates the presence of an AP phishing attack.

[0019] The specific implementation process of the string edit distance algorithm based on literal value matching includes: comparing it one by one with each legitimate SSID in a pre-configured whitelist of legitimate SSIDs, and calculating the minimum number of character insertion, deletion, or replacement steps required to convert an unknown SSID into any legitimate SSID. If the calculated edit distance is less than or equal to a set fixed edit distance threshold (e.g., set to 2), the unknown AP is determined to be a phishing AP and a security alarm is triggered.

[0020] The above-mentioned similarity calculation method based on pure literal values ​​or fixed prefixes has the following three drawbacks in actual AP phishing attack detection.

[0021] 1. Imbalance in the use of long and short strings (highly prone to false positives and false negatives). Because the character edit distance algorithm uses absolute counting, when the legitimate SSID is long (e.g., [Enterprise_Internal_WiFi]), an attacker only needs to add a long interference suffix (e.g., _Free_Zone) to the end, and the system will miss the detection because the edit distance far exceeds the set threshold. Conversely, if the legitimate SSID is short, the legitimate SSIDs of neighbors are very likely to trigger a large number of false positives due to accidental collisions with the smaller edit distance.

[0022] 2. Failure to defend against morphological distortion attacks. Plain text literal detection considers the Unicode encoding of characters and cannot identify "visual homograph attacks" that have different Unicode encodings but are visually similar (such as using Cyrillic or Greek letters in the Unicode character set that are extremely similar to English letters for forgery). This allows attackers to easily bypass plain text literal detection.

[0023] 3. Excessive prefix dependence. Algorithms such as Jaro-Winkler rely excessively on the weight of the beginning of the string. Once an attacker uses "prefix enhancement" techniques (such as adding Free_ before a legitimate name), the similarity score calculated by the algorithm will plummet, thus losing its ability to identify phishing attacks.

[0024] To address the technical problem of low accuracy in AP attack identification, this application provides an AP attack detection method. The core idea of ​​this method is to convert the SSID into an image and then extract view features (such as the number of endpoints, intersections, closed loops, holes, information density, and stroke tilting trends) to perform SSID comparison at the "visual feature" level. In this way, as long as the SSID visually deceives any legitimate SSID, the extracted visual features will be highly similar, thereby increasing the probability of intercepting AP attacks.

[0025] The AP attack detection method provided in this application embodiment can be applied to WIPS (Wireless Invasion Prevention System).

[0026] WIPS can include wireless sensors and processors.

[0027] The wireless sensor is used to monitor wireless frames sent and received between multiple terminals and a wireless access point (AP), and transmits frame analysis information of the monitored wireless frames to a processor. The frame analysis information may include the AP's MAC address, SSID (Service Set Identifier), etc. In some embodiments, the wireless sensors can be deployed in a distributed manner over the wireless air interface.

[0028] The processor is used to detect attacking APs according to the AP attack detection method provided in the embodiments of this application. For details, please refer to the following description, which will not be repeated here.

[0029] For example, see Figure 1 The diagram shown is a flowchart illustrating an AP attack detection method provided in an embodiment of this application. This method is applied to WIPS.

[0030] like Figure 1 As shown, in step 100, a target wireless frame is received from the target wireless access point (AP), and the target wireless frame includes a target service set identifier (SSID).

[0031] In some embodiments, the wireless sensor in WIPS can monitor the transmission, such as sending or receiving, of target wireless frames between multiple terminals and a target AP, and analyze the target SSID in the target wireless frame. Here, the target AP is any AP that the wireless sensor can monitor, the target wireless frame is any wireless frame transmitted between any terminal and the target AP, and the target SSID is the SSID in the target wireless frame.

[0032] The target wireless frame can be either a beacon frame or a probe response frame. For beacon frames, the access point (AP) actively broadcasts them to its surroundings at fixed time intervals (e.g., 10 times per second). For probe response frames, when a terminal wants to actively search for an available wireless network, it sends a probe request frame. Upon receiving this request, the AP will reply with a probe response frame if it meets the requested criteria.

[0033] In some embodiments, the target radio frame may further include a target basic service set identifier (BSSID), which may be a media access control address (MAC address); WIPS also includes a set of valid BSSIDs, and if the set of valid BSSIDs does not include the target BSSID, step 110 is performed.

[0034] In some implementations of this embodiment, WIPS includes a wireless sensor and a processor. The wireless sensor can receive a target wireless frame from the target AP, analyze the BSSID in the target wireless frame, and report it to the processor. If the set of valid BSSIDs does not include the target BSSID, the processor executes step 110.

[0035] In step 110, the target SSID is image-processed and then its visual features are extracted to obtain the target visual feature information of the target SSID.

[0036] In some embodiments, the wireless sensor can send the target SSID to the processor, and the processor can extract visual features from the target SSID after image processing to obtain the target visual feature information of the target SSID.

[0037] In some embodiments, the target visual feature information may include first visual feature information and / or second visual feature information.

[0038] The first visual feature information is used to characterize the visual features of each visible character in the target SSID. For example, the first visual feature information is the information obtained by replacing each visible character in the target SSID with its corresponding visual features. The visual features of each visible character include at least one of the following: number of endpoints, number of intersections, number of holes, information density, or stroke tilt trend.

[0039] The second visual feature information is used to characterize the visual features of at least one string in the target SSID that can be misidentified as a single character, and the visual features of all other visible characters besides the at least one string. Each string is a sequence of at least two consecutive characters in the target SSID. The visual features of each visible character and each string include at least one of the following: number of endpoints, number of intersections, number of holes, information density, or stroke tilt trend. For example, the second visual feature information is the information obtained by replacing several strings in the target SSID that can be misidentified as single characters and all other visible characters besides the strings with their corresponding visual features. A second visual feature information may involve one or more strings that can be misidentified as single characters, depending on the content of the target SSID. Furthermore, if there are no strings in the target SSID that can be misidentified as single characters, the target visual feature information does not include the second visual feature information.

[0040] For example, if the target SSID is H13C, the first visual feature information can include the visual features of each of the four visible characters H, 1, 3, and C. Since 13 can be visually misidentified as the single character B, the second visual feature information can include the visual features of each of the two visible characters H and C, as well as the visual features of the string 13.

[0041] Strings that can be misidentified as single characters can be visually deceptive, easily mistaken by users for similar-looking single characters. Correspondingly, the visual features of a string that can be misidentified as a single character have a high degree of similarity to the visual features of the single character that can be misidentified. For example, the string "()" can be visually misidentified as "0"; the string "13" can be visually misidentified as "B"; the string "VV" can be visually misidentified as "W"; the string "l_" can be visually misidentified as "L"; the string "C1" can be visually misidentified as "D"; and the string "1-1" can be visually misidentified as "H".

[0042] There can be one or more secondary visual feature information, depending on the potential for misidentification of the target SSID. Each secondary visual feature information corresponds to one or more strings that can be misidentified as single characters. When there are multiple strings, their positions within the target SSID should not overlap to reflect the actual situation of target SSID misidentification. However, the positions of strings corresponding to different secondary visual feature information within the target SSID can overlap. Therefore, for any given secondary visual feature information, at least one string that can be misidentified as a single character is at least partially misidentified as a single character in the target SSID, and the positions of these misidentified single-character strings within the target SSID do not overlap. Of course, in other cases, if a user, upon seeing the target SSID, might identify multiple strings with overlapping positions as single characters, then the positions of multiple strings related to any single secondary visual feature information within the target SSID can also overlap.

[0043] It should be noted that, considering that the target SSID may include multiple strings that can be misidentified as single characters, and the positions of multiple strings in the target SSID may overlap, in order to ensure the accuracy of visual feature comparison, a second visual feature information can be set for each string. If the positions of multiple strings in the target SSID do not overlap, a second visual feature information can be set for such multiple strings, and / or a second visual feature can be set for each string. The specific design can be combined with the actual situation.

[0044] For example, for each string that can be misidentified as a single character, the string corresponds to a second visual feature information, which can be used to characterize the visual features of the string and the visual features of each visible character other than the string.

[0045] For example, for multiple strings that can be misidentified as single characters, if the multiple strings do not overlap in the position of the target SSID, these strings correspond to a second visual feature information, which can be used to characterize the visual features of each of these strings and the visual features of each visible character other than these strings.

[0046] For example, if the target SSID is HC13, the first visual feature information can include the visual features of each of the four visible characters H, C, 1, and 3. 13 can be visually misidentified as the single character B, and C1 can be visually misidentified as the single character D. However, there is an overlap between the positions of 13 and C1 in HC13: the character 1. Therefore, there are two second visual feature information. One second visual feature information can include the visual features of each of the two visible characters H and C and the visual feature of the string 13. The other second visual feature information can include the visual features of each of the two visible characters H and 3 and the visual feature of the string C1.

[0047] For example, if the target SSID is HC1-1, then the first visual feature information can include the visual features of each of the five visible characters H, C, 1, -, 1. C1 can be visually misidentified as the single character D, and 1-1 can be visually misidentified as the single character H. However, there is an overlap between the positions of C1 and 1-1 in HC1-1: the character 1. Therefore, there are two second visual feature information. One second visual feature information can include the visual features of each of the three visible characters H, -, 1 and the visual features of the string C1. The other second visual feature information can include the visual features of each of the two visible characters H and C and the visual features of the string 1-1.

[0048] In some implementations of this embodiment, the wireless sensor can send the target SSID to the processor. The processor can then image-process the target SSID and send the resulting image and prompts to the AI ​​model. The AI ​​model uses the prompts to extract visual features from the input image (i.e., the image after image processing) to obtain the target visual feature information of the target SSID. The prompts guide the AI ​​model in visual feature extraction. For example, the prompts may include a list of strings that can be visually misidentified as single characters, a description of the visual features to be extracted, the image processing method, and the output. The image processing method includes: first, identifying each string in the input image that can be visually misidentified as a single character based on a list of strings that can be visually misidentified as single characters; then, extracting the visual features of each visible character and each string in the input image based on a description of the visual features to be extracted; then, forming first visual feature information from the visual features of each visible character in the input image; then, analyzing the array of misidentifiable strings in the input image based on the identified strings, where each misidentifiable string array includes at least one string; for any misidentifiable string array, forming second visual feature information from the visual features of each string in the misidentifiable string array and the visual features of each visible character other than the misidentifiable string array; and finally, outputting the first visual feature information and each of the second visual features.

[0049] In other implementations of this embodiment, the implementation of step 110 can be found in the following description of steps 111-113, and will not be repeated here.

[0050] In step 120, if the similarity between the target visual feature information of the target SSID and the visual feature information of any SSID in the set of legitimate SSIDs is greater than or equal to a preset threshold, then the target AP is determined to be an attack AP.

[0051] The visual feature information of any SSID in the set of legitimate SSIDs is obtained by visual feature extraction after image processing of the SSID. It should be noted that the image processing and visual feature extraction methods for any SSID in the set of legitimate SSIDs are similar to those for the target SSID. The difference is that the visual feature extraction of any SSID in the set of legitimate SSIDs does not need to consider strings that can be visually misidentified as single characters; it only needs to extract the visual features of each visible character in the SSID.

[0052] In some embodiments, for each SSID in the set of legitimate SSIDs, WIPS first calculates the similarity between the visual feature information of the SSID and the target visual feature information of the target SSID; for example, it calculates the distance between the visual feature information of the SSID and the target visual feature information, and uses the reciprocal of this distance as the similarity between the visual feature information of the SSID and the target visual feature information. Then, if the similarity between the visual feature information of the SSID and the target visual feature information of the target SSID is determined to be greater than or equal to a preset threshold, the target AP is determined to be an attack AP. The preset threshold can be designed according to actual needs, for example, it can be 95%.

[0053] It should be noted that the embodiments of this application are not intended to limit the detection logic of the legitimate SSID set. For example, the detection logic may first calculate the similarity between the visual feature information of each SSID in the legitimate SSID set and the target visual feature information of the target SSID, and then determine whether there is a similarity greater than or equal to a preset threshold. If so, the target AP is determined to be an attack AP. For example, the detection logic may first calculate the similarity between the visual feature information of any SSID in the legitimate SSID set and the target visual feature information of the target SSID, and determine whether the similarity is greater than a preset threshold. If so, the target AP is determined to be an attack AP; if not, the similarity between the visual feature information of any undetected SSID in the legitimate SSID set and the target visual feature information of the target SSID is calculated, and so on, until the target AP is determined to be an attack AP or the detection of all SSIDs in the legitimate SSID set is completed.

[0054] In some implementations of this embodiment, the target visual feature information can be first visual feature information and second visual feature information.

[0055] In one example of this implementation, WIPS calculates a first similarity between the visual feature information of the SSID and the first visual feature information of the target SSID for each SSID in the set of legitimate SSIDs. If the first similarity is greater than or equal to a preset threshold, the target AP is determined to be an attack AP. If the first similarity is less than the preset threshold, a second similarity is calculated between the visual feature information of the SSID and the second visual feature information of the target SSID. If the second similarity is greater than or equal to the preset threshold, the target AP is determined to be an attack AP. It should be noted that the embodiments of this application do not intend to limit the order in which the first and second similarities are calculated.

[0056] In another example of this implementation, for each SSID in the set of legitimate SSIDs, a first similarity between the visual feature information of the SSID and the first visual feature information of the target SSID, and a second similarity between the visual feature information of the SSID and the second visual feature information of the target SSID, can be calculated. Based on the first similarity and the second similarity, the similarity between the target visual feature information of the target SSID and the visual feature information of the SSID is determined.

[0057] For example, the similarity between the target visual feature information of the target SSID and the visual feature information of the SSID is the maximum value of the first similarity and the second similarity.

[0058] For example, the similarity between the target visual feature information of the target SSID and the visual feature information of the SSID is a weighted average of the first similarity and the second similarity. It should be noted that the weights of the first similarity and the second similarity can be designed according to actual needs, and this application embodiment does not specifically limit them.

[0059] In some embodiments, the font used for image processing of each SSID in the legitimate SSID set is the target font. The target font can be any font in the pre-defined font library in WIPS. Each SSID in the legitimate SSID set corresponds to the visual feature information of each font in the font library; thus, for any font, the target visual feature information of the target SSID for that font can be determined. If the similarity between the target visual feature information of the target SSID for that font and the visual feature information of any SSID in the legitimate SSID set for that font is higher than a preset threshold, the target AP is an attack AP.

[0060] For example, for any font in the font library, visual features are extracted from each SSID in the set of legitimate SSIDs after image processing using that font, resulting in visual feature information for each SSID in the set of legitimate SSIDs for that font. Subsequently, after obtaining the target SSID, visual features are extracted from the target SSID after image processing using that font, resulting in visual feature information for the target SSID for that font. If the similarity between the visual feature information of the target SSID for that font and the visual feature information of any SSID in the set of legitimate SSIDs for that font is greater than or equal to a preset threshold, the target AP is determined to be an attack AP.

[0061] It should be noted that by comparing the visual features of the target SSID and the SSIDs in the set of legitimate SSIDs for the same font, it is possible to more accurately identify whether the target SSID and the SSIDs in the set of legitimate SSIDs are visually similar, and thus more accurately identify visual attack APs.

[0062] In some embodiments, if WIPS determines that the target AP is an attacking AP, it blocks communication between the target AP and clients already connected to the target AP. In some implementations of this embodiment, WIPS sends a verification frame to both the target AP and clients already connected to the target AP. This verification frame can be a deassociation or deauthentication frame, thereby blocking wireless communication between the target AP and clients already connected to the target AP.

[0063] In this scheme, for the SSID in the wireless frame from the target AP, the visual features of the SSID are extracted after image processing to obtain the visual feature information of the SSID. The similarity between the visual feature information of the SSID and the visual feature information of any SSID in the list of legitimate SSIDs is compared. If the similarity is higher than a preset threshold, the target AP is determined to be an attack AP. In this way, visually similar SSIDs can be identified more accurately, and APs with visual attacks can be detected.

[0064] For example, see Figure 2 As shown, Figure 1 A flowchart of step 110.

[0065] like Figure 2 As shown, in step 111, the target SSID is processed into an image to determine the first character image of each visible character in the target SSID and the second character image of each string in at least one string in the target SSID that can be misidentified as a single character.

[0066] The first character image represents a visible character in the target SSID. The second character image represents a string that can be misidentified as a single character.

[0067] The target SSID can contain at least one string that can be misidentified as a single character. This can be one or more strings. If multiple strings are present, their positions within the target SSID do not overlap. Furthermore, at least one string can be at least a portion of the strings within the target SSID that can be misidentified as a single character. For example, if the target SSID is HC1-1, C1 can be visually misidentified as the single character D, and 1-1 can be visually misidentified as the single character H. The positions of C1 and 1-1 overlap within HC1-1. In step 111, a second character image is determined for either C1 or 1-1.

[0068] In some embodiments, a target SSID corresponds to one or more arrays of misidentifiable strings. Each array of misidentifiable strings describes the strings in the target SSID that may be misidentified. It may include at least one string in the target SSID that can be misidentified as a single character. If there are multiple strings, their positions in the target SSID may or may not overlap, depending on the potential for misidentification. Correspondingly, for any array of misidentifiable strings, that array is considered as at least one string in the target SSID that can be misidentified as a single character; that is, at least one string in the target SSID that can be misidentified as a single character is any array of misidentifiable strings for the target SSID.

[0069] In some implementations of this embodiment, WIPS determining the array of misidentifiable strings for a target SSID may include: first, WIPS can identify all strings in the target SSID that can be misidentified as single characters, and the positions of these strings in the target SSID may overlap; then, based on these strings, the array of misidentifiable strings for the target SSID is determined. In some implementations of this embodiment, WIPS can analyze the array of misidentifiable strings for the target SSID based on the number and order of visible characters in the target SSID, targeting a single string or a combination of multiple strings.

[0070] For example, to identify all strings in the target SSID that can be misidentified as single characters, WIPS can obtain a number of pre-set strings that can be misidentified as single characters, match each pre-set string with the target SSID, and identify each string in the target SSID that can be misidentified as single characters.

[0071] In some embodiments, the font used for the image processing of each SSID in the set of valid SSIDs is a target font. Correspondingly, WIPS performs image processing on the target SSID using the target font. The target font may contain graphic data for multiple characters specific to that target font, and the graphic data for any one character specific to that target font can generate a character image for that character specific to the target font.

[0072] In some implementations of this embodiment, for the generation of the first character image, WIPS visualizes each visual character in the target SSID using the target font to obtain the character image of the visual character. For example, the character image of the visual character is generated using the graphic information of the visual character included in the target font.

[0073] In some implementations of this embodiment, for the generation of the second character image, WIPS, for strings that can be misidentified as single characters, firstly, visualizes each visible character in the string using the target font to obtain character images of each visible character in the string. For example, it generates character images of each visible character in the string using the graphic information of each visible character in the string included in the target font. Then, according to the character order of the string, it combines the character images of each visible character in the string that can be misidentified as a single character to obtain the second character image.

[0074] In some embodiments, in step 111, WIPS can first perform image processing on the target SSID to determine the target image of the target SSID. For example, by using the graphic information of each visible character in the target SSID included in the target font, a target image of each visible character in the target SSID is generated. Then, according to the character order of each visible character in the target SSID, the target images of each visible character in the target SSID are combined to obtain the target image of the target SSID.

[0075] Then, WIPS extracts the character skeleton from the target image to obtain a character skeleton image. For example, a thinning algorithm can be used to extract the character edges formed by single pixels in the target image to obtain the character skeleton image. In this way, the width of the lines in the character skeleton image can be the width of a single pixel in the target image. It should be noted that this embodiment first generates an image of the target SSID, and then thins the edges of the image to improve image quality.

[0076] Finally, WIPS extracts the first character image containing each visible character in the character skeleton image and the second character image containing at least one string that is visually similar to a single character.

[0077] In some examples, WIPS can cut the character skeleton image according to a preset single character spacing to obtain the first character image.

[0078] In some examples, WIPS can determine the position of each string in the character skeleton image for each string that is visually similar to a single character, extract the content of that string position from the character skeleton image, and obtain a second character image.

[0079] In step 112, visual features are extracted from the first character image of each visible character and the second character image of each string in at least one string to obtain the visual feature information of each visible character and the visual feature information of each string in at least one string.

[0080] In some embodiments, the visual feature information of each visible character and the visual feature information of the string include at least one of the following: number of endpoints, number of intersections, number of holes, information density, or stroke tilt trend.

[0081] The visual feature extraction of the first character image by WIPS can then include: For any first character image of a visible character, if any pixel in the first character image is connected to only one pixel in its neighborhood, such as 8-neighborhood, then that pixel is an endpoint, and the number of endpoints is taken as the number of endpoints of the visible character. For any first character image of a visible character, if any pixel in the first character image is connected to at least two pixels in its neighborhood, such as 8-neighborhood, then the pixel is an intersection point, and the number of intersection points is taken as the number of intersection points of the visible character. For any first character image of a visible character, identify the number of connected regions and the number of closed loops in the first character image. Based on the number of connected regions and the number of closed loops, determine the number of holes in the visible character. For example, the number of holes is the difference between the number of connected regions and the number of closed loops. For any visible character in the first character image, a first sliding traversal is performed on the first character image based on the first window, and the information density of the content of each window in the first sliding traversal is calculated to obtain the information density of the visible character. That is, the information density of the visible character is the information density of the content of each window in the first sliding traversal. The information density of any window content in the first window is determined based on the number of pixels with a pixel value greater than 0 and the total number of pixels in the window content. For example, the information density of a window content is the ratio of the number of pixels with a pixel value greater than 0 to the total number of pixels in the window content. For instance, if the first character image is a binary image, then the information density of a window content is the ratio of the number of pixels with a pixel value equal to 1 to the total number of pixels in the window content. For any given visual character in the first character image, a second sliding traversal is performed on the first character image based on the second window, and the stroke tilt trend of each window content in the second window during the second sliding traversal is calculated to obtain the stroke tilt trend of the visual character. In other words, the stroke tilt trend of the visual character is the stroke tilt trend of each window content during the second sliding traversal. The stroke tilt trend of any window content in the second window is determined based on the pixel values ​​of that window content in each of a preset plurality of directions. These preset plurality of directions can be 0°, 45°, 90°, or 135°. For example, the stroke tilt trend of a window content is obtained by averaging the pixel values ​​of that window content in each of the preset plurality of directions.

[0082] It should be noted that the size of the first and second windows can be designed according to actual needs, such as 3*3 or 4*4, and can be the same or different. In addition, the step size of the first and second sliding traversals (which can include the step size in the left and right directions and the step size in the up and down directions) can be the same or different, and can be designed according to actual needs.

[0083] For WIPS's visual feature extraction of the second character image for each string in at least one string, please refer to the first character image; it will not be repeated here.

[0084] In step 113, the first visual feature information of the target SSID is determined based on the visual feature information of each visible character.

[0085] In some embodiments, WIPS can replace each visible character in the target SSID with the corresponding visual feature information to obtain the first visual feature information of the target SSID.

[0086] In step 114, the second visual feature information of the target SSID is determined based on the visual feature information of each string in at least one string and the visual feature information of each visible character other than at least one string.

[0087] In this embodiment of the application, WIPS can replace each string in at least one string in the target SSID with the corresponding visual feature information, and replace each visible character other than at least one string with the corresponding visual feature information to obtain the first visual feature information of the target SSID.

[0088] For example, at least one string is 1, which is any string in the SSID that can be misidentified as a single character. For any string in the SSID that can be misidentified as a single character, WIPS determines the second visual feature information of the target SSID based on the visual feature information of the string and the visual feature information of each visible character other than the string.

[0089] For example, if the target SSID is H13C and there are five character images representing H, 1, 3, C, and 13, then the first visual feature information can include the visual feature information of the four characters H, 1, 3, and C. Since 13 is similar to the single character B, the second visual feature information can include the visual feature information of each of H, 13, and C.

[0090] For example, at least one string is multiple strings, which are any multiple strings in the SSID that can be misidentified as a single character. WIPS determines the second visual feature information of the target SSID based on the visual feature information of these strings and the visual feature information of each visible character other than these strings.

[0091] In this scheme, by considering each visible character and strings that can be misidentified as single characters, possible visual features of the SSID are obtained, thereby increasing the reliability of feature matching.

[0092] It should be noted that steps 111-114 above describe an implementation method for determining the first visual feature information and any one of the second visual feature information. This implementation method is merely an example and does not constitute a specific limitation. In some embodiments, WIPS determining all second visual features may include: First, the target SSID is processed into an image to determine the first character image of each visible character in the target SSID and the second character image of each string that can be misidentified as a single character for the target SSID. Here, the string is any string of the target SSID that may be misidentified. If there are multiple strings, the positions of the multiple strings in the target SSID may overlap.

[0093] Then, visual features are extracted from the first character image of each visible character and the second character image of each string to obtain the visual feature information of each visible character and the visual feature information of each string.

[0094] Then, if the target SSID contains strings that can be misidentified as single characters, WIPS first determines the array of misidentifiable strings for the target SSID based on each string.

[0095] In some implementations, WIPS can analyze the array of misidentifiable strings of a target SSID based on the number and order of visible characters in the target SSID, targeting a single string or a combination of multiple strings.

[0096] In some implementations, WIPS treats any string in the SSID that can be misidentified as a single character as an array of misidentifiable strings. If there are multiple strings that can be misidentified as single characters, it combines any number of strings in the target SSID that do not have positional overlap to obtain an array of misidentifiable strings.

[0097] Finally, for each misidentifiable string array, WIPS determines the second visual feature information of the target SSID based on the visual feature information of each string in the misidentifiable string array and the visual feature information of each visible character other than the misidentifiable string array.

[0098] The AP attack detection method provided in this application embodiment will be described in detail below with reference to a specific WIPS architecture.

[0099] WIPS can include distributed wireless sensors deployed on the wireless air interface, a WIPS central processing unit, and memory. The memory includes a font library and an SSID whitelist (i.e., the aforementioned set of legitimate SSIDs). The font library can include several fonts. Therefore, the AP attack detection method can include the following steps.

[0100] Step 1: Information Frame Acquisition and SSID Extraction. The wireless sensor continuously listens for wireless information frames in the wireless access point (AP), such as beacon frames or probe response frames, parses the AP's SSID, and reports it to the WIPS central processing unit in real time.

[0101] Step 2: Dynamic Bitmap Rendering. The WIPS central processing unit calls the system's built-in font library to render the captured SSID and each legal SSID in the SSID whitelist into a binary image at a specified resolution (e.g., 32*256 pixels), thus obtaining the binary images of the captured SSID and each legal SSID in the font library.

[0102] Step 3: Character skeleton fingerprint and topological feature extraction. For each valid SSID's binary image, the WIPS central processing unit performs image preprocessing, such as extracting the character skeleton of the string using a thinning algorithm (e.g., Zhang-Suen), resulting in a character skeleton image (representing the geometric skeleton of the string). Subsequently, it extracts individual character images of each visible character from the character skeleton image and extracts four types of visual features from each individual character image.

[0103] The first category is endpoint and intersection (Node Detection). Each pixel in a single-character image is scanned, and the number of connected pixels in its 8-neighborhood is calculated. If only one pixel in the 8-neighborhood is connected, the point is defined as an endpoint (e.g., the top and bottom ends of the letter 'c'). If three or more pixels in the 8-neighborhood are connected, the point is defined as an intersection / branch point (e.g., the center of the letter 'x' or the intersection of the horizontal and vertical axes of the letter 't').

[0104] The second type is the Euler number. The number of holes (also known as the topological Euler number) in a single character image is calculated as the number of connected components minus the number of closed cycles, accurately identifying characters with closed structures (e.g., the number 0, letters o, p, and a each contain one hole, and the letter B contains two holes). This is the most robust geometric feature against Unicode homograph deception.

[0105] The third category is information density: calculating the proportion of black pixels within each 4 * 4 subgrid in a single character image.

[0106] The fourth type is the direction vector. The Sobel operator is used to extract the projection vectors of a single character image in four directions: 0°, 45°, 90°, and 135°, and these vectors are then fused, for example, by weighted averaging, to characterize the tilting trend of the strokes.

[0107] Finally, the number of endpoints, intersections, holes, information density of each subgrid, and direction vector of each extracted single-character image are concatenated to dynamically generate a high-dimensional visual feature vector matrix (i.e., the first visual feature information mentioned above) for the SSID: in, The array represents the structural features of the i-th character, where i = 1, 2, ..., m, and m is a positive integer greater than or equal to 1. This array represents the number of endpoints, intersections, holes, information density of each subgrid, and direction vector of the character. This matrix serves as a unique "visual biometric fingerprint" for this SSID.

[0108] For a captured SSID, firstly, character images of each visible character in the captured SSID are extracted as described above to obtain the visual feature vector matrix of the SSID. Then, according to pre-set strings that can be misidentified as single characters, it is identified whether there are strings in the SSID that can be misidentified as single characters. If so, string images of each string are extracted from the character skeleton image, and four types of visual features are extracted from each string image. For each string, the four types of visual features of the string and the four types of visual features of each visible character outside the string are concatenated to obtain the visual feature vector matrix of the SSID (that is, the second visual feature information mentioned above). Multiple strings in the SSID that do not have positional intersections are combined to obtain string combinations. For each string combination, the four types of visual features of each string in the string combination and the four types of visual features of each visible character outside the string combination are concatenated to obtain the visual feature vector matrix of the SSID (that is, the second visual feature information mentioned above).

[0109] Step 4: Matrix Similarity Calculation and Adjudication. For any font in the font library, the WIPS central processing unit calculates the distance (e.g., cosine similarity or Hamming distance) between the captured SSID's visual feature vector matrix for that font and the visual feature vector matrices of each SSID in the legal whitelist for that font, obtaining a similarity score, such as the reciprocal of the distance. If the calculated similarity score is greater than a preset threshold (e.g., 95%), and the AP's BSSID (e.g., MAC address) is not in the whitelist, then the AP is determined to constitute a visual homograph phishing attack.

[0110] Step 5: Reverse Wireless Blocking. Once a phishing AP is identified, the WIPS central processing unit immediately sends a blocking command to the wireless sensor that detected the signal. The wireless sensor then sends deassociation or deauthentication frames to the phishing AP and its associated clients, forcibly blocking wireless communication between them.

[0111] It should be noted that in steps 2 and 3, the visual biometric fingerprint of each SSID in the SSID whitelist for each font in the font library can be determined in advance; there is no need to continue steps 2 and 3 simultaneously with the captured SSID.

[0112] For example, see Figure 3 The diagram shown is a structural schematic of an AP attack detection device provided in an embodiment of this application. This device is applied to a wireless intrusion prevention system and includes a frame receiving module 300, a feature extraction module 310, and an attack identification module 320. The frame receiving module 300 is used to receive a target wireless frame from a target wireless access point (AP), the target wireless frame including a target service set identifier (SSID). The feature extraction module 310 is used to extract visual features from the target SSID after image processing to obtain the target visual feature information of the target SSID; The attack identification module 320 is used to determine that the target AP is an attack AP if the similarity between the target visual feature information of the target SSID and the visual feature information of any SSID in the set of legitimate SSIDs is greater than or equal to a preset threshold. The visual feature information of any SSID in the set of legitimate SSIDs is obtained by visual feature extraction after image processing of the SSID.

[0113] In some embodiments, the target visual feature information includes first visual feature information and / or second visual feature information; The first visual feature information is used to characterize the visual features of each visible character in the target SSID; The second visual feature information is used to characterize the visual features of at least one string in the target SSID that can be misidentified as a single character, and the visual features of each visible character other than the at least one string.

[0114] In some implementations of this embodiment, the visual feature information of any SSID in the set of legitimate SSIDs is used to characterize the visual features of each visible character in that SSID; Target visual feature information includes first visual feature information and second visual feature information; The similarity between the target visual feature information of the target SSID and the visual feature information of any SSID in the set of legal SSIDs is the maximum value of the first similarity between the first visual feature information of the target SSID and the first similarity between the second visual feature information of the target SSID and the second similarity between the second visual feature information of the target SSID and the second similarity between the second visual feature information of the target SSID and the second similarity between the second visual feature information of the target SSID, or the weighted average of the first similarity and the second similarity.

[0115] In some implementations of this embodiment, the feature extraction module 310 is used to perform image processing on the target SSID, determine the first character image of each visible character in the target SSID and the second character image of each string in at least one string in the target SSID that can be misidentified as a single character; perform visual feature extraction on the first character image of each visible character and the second character image of each string to obtain the visual feature information of each visible character and the visual feature information of each string; determine the first visual feature information of the target SSID based on the visual feature information of each visible character; and determine the second visual feature information of the target SSID based on the visual feature information of each string and the visual feature information of each visible character other than each string.

[0116] In one example of this implementation, the visual features of each visual character and the visual features of at least one string include at least one of the following: number of endpoints, number of intersections, number of holes, information density, and stroke tilt trend.

[0117] In some embodiments, the font used for the image processing of each SSID in the set of legitimate SSIDs is the target font; the feature extraction module 310 is used to extract visual features after the image processing of the target SSID using the target font.

[0118] In some embodiments, the target radio frame may also include a target basic service set identifier (BSSID); Wireless intrusion prevention systems also include a set of legitimate BSSIDs; The device also includes a verification module for performing feature extraction module 310 when the set of valid BSSIDs does not include the target BSSID.

[0119] These units can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when one of these units is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these units can be integrated together to form a system-on-a-chip (SOC).

[0120] Furthermore, regarding the AP attack detection device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the AP attack detection device can be found in [reference needed]. Figure 4 As shown, the AP attack detection device may include: a memory 400 and a processor 410. The memory 400 is used to store program instructions; the processor 410 calls the program instructions stored in the memory 400 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar, and will not be described again here.

[0121] Optionally, this application also provides a distributed communication device, including at least one processing element (or chip) for performing the above method embodiments.

[0122] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the above-described method embodiments.

[0123] Here, a machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, a machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0124] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0125] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0126] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0127] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0128] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0129] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0130] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An AP attack detection method, characterized in that, Applied to a wireless intrusion prevention system, the method includes: Receive a target radio frame from a target wireless access point (AP), the target radio frame including a target service set identifier (SSID); After the target SSID is image-processed by the target font, visual features are extracted to obtain the first visual feature information and the second visual feature information of the target SSID. The first visual feature information is used to characterize the visual features of each visible character in the target SSID, and the second visual feature information is used to characterize the visual features of at least one string in the target SSID that can be misidentified as a single character and the visual features of each visible character other than the at least one string. If the similarity between the first or second visual feature information of the target SSID and the visual feature information of any SSID in the set of legitimate SSIDs is greater than or equal to a preset threshold, or if the weighted average obtained by weighting the similarity between the first and second visual feature information and the visual feature information of any SSID in the set of legitimate SSIDs is greater than or equal to a preset threshold, then the target AP is determined to be an attack AP. The visual feature information of any SSID in the set of legitimate SSIDs is obtained by visual feature extraction after the SSID is image-processed by the target font. The visual feature information of any SSID in the set of legitimate SSIDs is used to characterize the visual features of each visible character in the SSID.

2. The method as described in claim 1, characterized in that, The step of image processing of the target SSID using the target font followed by visual feature extraction to obtain the first visual feature information and the second visual feature information of the target SSID includes: The target SSID is image-processed using the target font to determine the first character image of each visible character in the target SSID and the second character image of each string in at least one string in the target SSID that can be misidentified as a single character; Visual features are extracted from the first character image of each visible character and the second character image of each string to obtain the visual feature information of each visible character and the visual feature information of each string; Based on the visual feature information of each visible character, the first visual feature information of the target SSID is determined; Based on the visual feature information of each string and the visual feature information of each visible character other than the strings, the second visual feature information of the target SSID is determined.

3. The method as described in claim 1, characterized in that, The visual features of each visible character and the visual features of each of the at least one string include at least one of the following: number of endpoints, number of intersections, number of holes, information density, and stroke tilt trend.

4. The method according to any one of claims 1 to 3, characterized in that, The target radio frame also includes a target basic service set identifier (BSSID); The wireless intrusion prevention system also includes a set of legitimate BSSIDs; The method further includes: If the set of valid BSSIDs does not include the target BSSID, the step of performing visual feature extraction after image processing of the target SSID using the target font is executed to obtain the target visual feature information of the target SSID.

5. An AP attack detection device, characterized in that, The device, used in a wireless intrusion prevention system, includes: Frame receiving module, used to receive target wireless frames from target wireless access point AP, the target wireless frames including target service set identifier (SSID); The feature extraction module is used to extract visual features after the target SSID is image-processed by the target font, so as to obtain the first visual feature information and the second visual feature information of the target SSID. The first visual feature information is used to characterize the visual features of each visible character in the target SSID, and the second visual feature information is used to characterize the visual features of at least one string in the target SSID that can be misidentified as a single character and the visual features of each visible character other than the at least one string. The attack identification module is configured to determine that the target AP is an attack AP if the similarity between the first visual feature information or the second visual feature information of the target SSID and the visual feature information of any SSID in the set of legitimate SSIDs is greater than or equal to a preset threshold, or if the weighted average obtained by weighting the similarity between the first visual feature information and the second visual feature information and the visual feature information of any SSID in the set of legitimate SSIDs is greater than or equal to a preset threshold. The visual feature information of any SSID in the set of legitimate SSIDs is obtained by visual feature extraction after image processing of the SSID, and the visual feature information of any SSID in the set of legitimate SSIDs is used to characterize the visual features of each visible character in the SSID.

6. The apparatus as claimed in claim 5, characterized in that, The feature extraction module is used to perform image processing on the target SSID using the target font, and determine the first character image of each visible character in the target SSID and the second character image of each string in at least one string in the target SSID that can be misidentified as a single character; Visual features are extracted from the first character image of each visible character and the second character image of each string to obtain the visual feature information of each visible character and the visual feature information of each string; Based on the visual feature information of each visible character, the first visual feature information of the target SSID is determined; Based on the visual feature information of each string and the visual feature information of each visible character other than the strings, the second visual feature information of the target SSID is determined.

7. The apparatus as claimed in claim 5, characterized in that, The visual features of each visible character and the visual features of each of the at least one string include at least one of the following: number of endpoints, number of intersections, number of holes, information density, and stroke tilt trend.

8. The apparatus as claimed in any one of claims 5 to 7, characterized in that, The target radio frame also includes a target basic service set identifier (BSSID); The wireless intrusion prevention system also includes a set of legitimate BSSIDs; The device further includes: The verification module is used to execute the feature extraction module if the set of valid BSSIDs does not include the target BSSID.

9. An AP attack detection device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the method of any one of claims 1-4 according to the obtained program instructions.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-4.

Images