CN108521632B

CN108521632B - Wi-Fi (wireless fidelity) -based real-time social relationship discovery system and implementation method

Info

Publication number: CN108521632B
Application number: CN201810299476.8A
Authority: CN
Inventors: 刘宁; 王晓鹏
Original assignee: Sun Yat Sen University
Current assignee: Sun Yat Sen University
Priority date: 2018-04-04
Filing date: 2018-04-04
Publication date: 2021-05-28
Anticipated expiration: 2038-04-04
Also published as: CN108521632A

Abstract

The invention discloses a real-time social relationship discovery system based on Wi-Fi and an implementation method thereof, wherein the system comprises a Wi-Fi data acquisition module, a data processing module, a control module, a classification module, a figure relationship calculation module and a sending module. The real-time social relationship discovery system based on Wi-Fi provided by the invention can dig out the hidden equipment relationship in the current scene by using the SSID list as much as possible, and construct a character (equipment) relationship network which is deeper and wider than the original scheme. The method does not need additional resource deployment, effectively solves the problem that most equipment can not obtain the SSID list because the direct probe request frame is not sent any more at present, and simultaneously adds the equipment connected with the network into the relational network.

Description

Wi-Fi (wireless fidelity) -based real-time social relationship discovery system and implementation method

Technical Field

The invention relates to a Wi-Fi-based real-time social relationship discovery system and an implementation method.

Background

With the development of communication technology and internet technology, Wi-Fi technology has gained wide recognition and acceptance by its advantages. According to the 40 th statistical report of the development conditions of the Chinese Internet, which is issued by the information center of the Chinese Internet, the scale of Chinese mobile netizens reaches 7.51 hundred million as shown in 6 months in 2017, in addition, in the last half year of 2017, users can use Wi-Fi to surf the Internet in average 61% of the time, and the ratio of the time of using Wi-Fi by more than 50% of the users exceeds 70%. Therefore, the method has a wide application prospect in mining the information of the mobile terminal to discover the social relationship based on the Wi-Fi. Binding time, which can capture the flow of people over a period of time; in combination with the space, it is possible to compare the person layout within the respective areas. Furthermore, the method can be used for carrying out regional crowd relation closeness assessment, crime group prediction, people flow abnormity discovery, targeted advertising and the like, and has great market demand and application value.

Currently, the main material used in social relationship discovery using Wi-Fi is a probe request frame in the IEEE802.11 protocol set, which belongs to a management frame. A Wi-Fi enabled device will use this frame to scan which 802.11 wireless networks are in the area. More specifically, when scanning, probe request frames can be divided into two categories: direct probe and Broadcast probe. For the Direct probe request frame, the length of the SSID field is not 0, and the Direct probe request frame is one of networks (SSIDs) which are connected with the current equipment; and for the Broadcast probe request frame, the SSID field length is 0. Therefore, by continuously monitoring probe request frames (more specifically, direct probe request frames) sent by the device, an SSID List (i.e., a Preferred Network List, PNL for short) that the device has been connected to can be obtained, so as to extract hidden information of a user holding the device.

According to the participation degree of the SSID list, the method for discovering the social relationship by using the Wi-Fi can be divided into two types, namely that the SSID list is used for discovering, and other information is combined for discovering.

Wherein social relationship discovery is performed for SSID lists alone. The paper [ Barbera M V, Epasto A, Mei A, et al. signs from the crown: uncovered social relationships through social network protocols [ C ]// Conference on Internet social network Conference. ACM,2013: 265. 276] utilizes the similarity degree of the SSID list among the devices to construct the social network, and compares with the known social network, so that the social network constructed by utilizing the similarity degree of the SSID list meets the homogeneity theory (homology theory) in the social theory. Paper [ Cunche M, Kaafar M A, Boreli R.Linking Wireless devices using information in Wi-Fi protocol [ J ]. Pervasive & Mobile Computing,2014,11(4):56-69 ]! Linking Wireless devices using Wi-Fi protocol requests [ C ]// World of Wireless, Mobile and Multimedia networks. IEEE 2012:1-9 ] compares several existing algorithms for calculating SSID list similarity, and improves one of the algorithms, so that the conjecture of the crowd obtains better effect.

For social relationship discovery using SSID lists and in combination with other information. The paper [ Cheng N, Mohapatra P, Cunche M, et al. introduction user correlation from development in WLANs [ C ]// Military Communications Conference,2012-Milcom. IEEE,2012:1-6 ] uses the SSID list in addition to the consideration of the location relationship between devices and the probability of spatio-temporal co-occurrence to complete the inference of the group relationship. Papers [ Luzio A D, Mei A, Stefa J.Mind your probes: De-immunization of large rows through small microphone WiFi probe requests [ C ]// IEEE INFOCOM 2016-the IEEE International Conference on Computer communications. IEEE,2016 ] add to the SSID list the geographical location of each SSID in consideration to complete the inference of the origin of the population. Paper [ Hong H, Luo C, Chan M C. Social Probe: outstanding Social Interaction Through Passive WiFi Monitoring [ C ]// International Conference on Mobile and Ubiotous Systems: Computing, WORKING and services. ACM,2016:94-103 ] adds to the SSID list, and also considers the signal strength of the frame to make the estimation of the crowd relationship.

For the social relationship discovery by using the SSID list and combining other information, the real-time performance is poor, and the purpose can be achieved only by additional resource deployment. Methods such as the paper [ Cheng N, Mohapatra P, Cunche M, et al, introduction user correlation from development in WLANs [ C ]// Military Communications Conference,2012-Milcom. IEEE,2012:1-6 ], require multiple acquisitions by multiple listeners to be deployed and collected for a long period of time before a better result can be obtained. The method of the paper [ Hong H, Luo C, Chan M C. SocialProbe: outstanding Social Interaction Through Passive WiFi Monitoring [ C ]// International Conference on Mobile and Ubiotous Systems: Computing, WORKING and services. ACM,2016:94-103 ] also requires the deployment of multiple monitors inside the experimental site to achieve the goal. The methods of the papers [ Luzio A D, Mei A, Stefa J.Mind your probes: De-immunization of large rows through small microphone WiFi probe requests [ C ]// IEEE INFOCOM 2016-the IEEE International Conference on Computer communications. IEEE,2016 ] require that the geographic location of each SSID be known in advance, and that no team or person in the country has yet publicly provided this more complete data. For example, although the aggregated data provides an API interface named 'national WiFi', the amount of data contained is very small and insufficient to implement the method of the paper. In other words, if the method is to be implemented domestically, a relatively complete national WiFi data needs to be acquired first, which results in a huge workload.

And for the method of only using the SSID list to discover the social relationship, though the real-time performance is better, no additional resource deployment is needed. However, with the improvement of the awareness of the user on privacy security protection, most devices do not send direct probe request frames for network discovery, and the amount of fingerprints which can be acquired is greatly reduced. The effectiveness of the methods of all the above papers is affected to different degrees and does not achieve the desired effect. In addition, the above-mentioned paper only considers the relationship of devices that are not connected to the network but open the Wi-Fi function in the scene, and does not add devices connected to the network.

Disclosure of Invention

The invention mainly aims to provide a real-time social relationship discovery system based on Wi-Fi and an implementation method thereof, so as to effectively solve the problems.

In order to solve the technical problems, the technical scheme adopted by the invention is as follows:

a Wi-Fi based real-time social relationship discovery system, comprising:

the Wi-Fi data acquisition module is responsible for capturing and analyzing frame data in a wireless network environment, and then respectively transmitting the analyzed data into the data processing module for calculation according to different requirements;

the data processing module comprises an AP encryption mode training module, an equipment connection state analysis module and a replay database construction module, wherein the AP encryption mode training module updates a training model according to the transmitted AP information and is used for predicting the encryption mode of the AP replayed at the later stage; the equipment connection state analysis module can judge the equipment connection state in the current monitoring environment; the replay database construction module constructs or updates a database to be replayed according to the transmitted data; the data processing module feeds back the calculation result information to the control module;

the control module judges whether the degree of the currently acquired information can call the classification module or not, whether the person relation calculation module can be called or not and what data is sent;

the classification module is used for classifying the equipment according to the acquired equipment information and giving a classification result to improve the efficiency of next playback;

the figure relation calculation module is responsible for calculating the similarity of the SSID list by utilizing the SSID list of each device which is finally excavated so as to obtain the relation between the devices;

and the sending module sends the data according to the data and the instruction provided by the control module.

The implementation method of the real-time social relationship discovery system based on Wi-Fi comprises the following steps: the wireless network card is enabled to work in a monitoring mode to capture frame data under a wireless network environment, wherein the frame data comprises a control frame, a management frame and a data frame, and the frame data is analyzed to extract effective information.

Preferably, the valid information includes a MAC address of the device, a MAC address of the AP, an encryption method of the AP, an SSID requested by the device, and a device MAC address responded by the AP.

Preferably, random MACs are identified and filtered out during the acquisition process to improve efficiency. Preferably, the AP encryption mode training is realized by using a classifier.

Preferably, in the classification module, the acquired device information is a currently known SSID list, and DB-SCAN is used as a classification method.

Preferably, in the figure relation estimation module, the similarity of the SSID list is calculated by adopting a Psim-q method.

Preferably, the sending module is further provided with a traceless interrupt function, and the interrupt function is executed in a time which is not perceived by a user, so as to trigger the device to scan the network again, thereby enabling the device to answer the played SSID.

The real-time social relationship discovery system based on Wi-Fi provided by the invention can dig out the hidden equipment relationship in the current scene by using the SSID list as much as possible, and construct a character (equipment) relationship network which is deeper and wider than the original scheme. The method does not need additional resource deployment, effectively solves the problem that most equipment can not obtain the SSID list because the direct probe request frame is not sent any more at present, and simultaneously adds the equipment connected with the network into the relational network.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this application, illustrate embodiments of the invention and, together with the description, serve to explain the invention and not to limit the invention. In the drawings:

FIG. 1 is a block diagram of a system according to an embodiment of the present invention;

FIG. 2 is a flow chart of an acquisition module according to an embodiment of the present invention;

FIG. 3 is a flowchart of an AP encryption mode training module according to an embodiment of the present invention;

fig. 4 is a flow chart of a sending module according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

Examples

Aiming at the defects of the existing social relationship discovery method based on Wi-Fi, the new system and the implementation method for real-time social relationship discovery based on Wi-Fi are provided, no additional resource deployment is needed, the condition that most of the existing devices do not send direct probe request frames any more for network discovery is considered, and meanwhile, the devices which are connected with the network in the scene are also taken into consideration.

As shown in fig. 1, the system is composed of a Wi-Fi data acquisition module, a data processing module, a control module, a classification module, a person relation calculation module and a person relation sending module. The Wi-Fi data acquisition module is responsible for capturing and analyzing frame data in a wireless network environment, and then respectively transmitting the analyzed data into the AP encryption mode training module, the equipment connection state analysis module and the replay database construction module according to different requirements to calculate to obtain a result. The AP encryption mode training module can update a training model according to the transmitted AP information and is used for predicting the encryption mode of the AP replayed at the later stage; the device connection state analysis module can determine the device connection state (Wi-Fi is turned on but not connected to a network or connected to a network) in the current monitoring environment; the replay database construction module will construct or update the database to be replayed from the incoming data. The three modules all feed back calculation result information to the control module, and the control module judges whether the degree of the currently acquired information can call the classification module or not, can call the character relation calculation module or not and sends data. And the sending module sends the data according to the data and the instruction provided by the control module.

Acquisition module design and implementation

The acquisition module is responsible for capturing frame data under a wireless network environment, including control frames, management frames and data frames, and performing frame data analysis to extract effective information (including an MAC address of the device, an MAC address of the AP, an encryption mode of the AP, an SSID requested by the device, a MAC address of the device responded by the AP, and the like).

The wireless network card needs to work in a monitoring mode to achieve the purpose. And because of the influence of MAC randomization, random MAC is also needed to be identified and filtered out in the acquisition process so as to improve the efficiency. The flow chart of the acquisition module is shown in fig. 2.

AP encryption mode training module design and implementation

The AP encryption mode training module is responsible for updating a training set by utilizing the AP information mined in the acquisition module and providing an encryption mode prediction function for the AP which does not know the encryption mode.

Training and prediction in the module are completed by using a classifier, so that the encryption mode of the unknown AP can be predicted more accurately. Among them, there are three types of encryption schemes used for training: WPA/WPA2, WEP, no encryption. A flowchart of the AP encryption mode training module is shown in fig. 3.

Device connection state module design and implementation

The equipment connection state module is responsible for judging the connection state of the equipment according to the effective information provided by the acquisition module. More specifically, whether the device is on Wi-Fi function but not connected to a network can be determined, and if not, the network (i.e., AP) to which the device is connected can be further determined. On the other hand, the module can also count the number of the monitored AP equipment connections under the current environment, namely specific information.

Control module design and implementation

The control module is responsible for judging whether the degree of the currently collected information can call the classification module or not, whether the person relation calculation module can be called or not and what data is sent.

Classification Module design and implementation

The classification module is responsible for classifying the equipment according to the collected equipment information (the currently known SSID list) and giving a classification result to improve the efficiency of next playback. The strategy of 'divide and conquer' can be adopted in the next playback, and the SSID which is most likely to hit the group is played back aiming at different groups, so that the hit probability is improved, and the whole playback times are reduced. Wherein DB-SCAN is used as the classification method.

Design and implementation of figure relation calculation module

And the figure relation calculation module is the last step of the whole social relation discovery process. And the SSID list of each device which is finally excavated is used for carrying out similarity calculation of the SSID list, so that the relationship among the devices is obtained. The method for calculating the SSID list similarity is selected from a paper [ Cunche M, Kaafar M A, Boreli R.Linking wireless devices using information consistent in Wi-Fi probe requests [ J ]. Pervasive & Mobile Computing,2014,11(4):56-69 ], and is a Psim-q method, and the calculation formula is as follows:

transmit module design and implementation

The sending module is responsible for receiving the replay data and the instruction transmitted by the control module and selecting a corresponding strategy to send so as to achieve the purpose of inducing the SSID connected with the equipment.

In order to acquire the SSID list of the connected network device, the sending module further provides a traceless interrupt function, that is, in a time imperceptible to a user, an interrupt operation is executed to trigger the device to re-scan the network, so that the device can respond to the played SSID.

The sending module receives two parts of contents transmitted from the control module, wherein the first part is replay data and comprises an SSID (service set identifier) obtained from the replay database construction module and an encryption mode of the SSID obtained by the AP encryption mode training module; the second part is a command to clarify the group to which the current playback is directed. Aiming at the size of a target group, the system can autonomously select a specific replay method, and when the group is fully covered, the beacon frame is forged to carry out replay induction; when the group only aims at a part, probe response frames are forged for replay induction, so that the influence of replay operation on the whole environment is reduced, and the success rate of induction in unit time is improved. And before playback starts, the system checks the target group, and performs traceless breaking (forging disconnection and authentication frames) on the connected network devices to prompt the connected network devices to restart scanning operation so as to perform the next playback induction. After the forged frame is sent (i.e. the SSID is replayed), the response of the target group to the sending is taken charge of by the acquisition module. The flow chart of the sending module is shown in fig. 4.

According to the scheme, through the playback and traceless interruption technology, the similarity of the SSID list is utilized, additional resource deployment is not needed, the condition that most of devices do not send direct probe request frames to discover the network at present is considered, and meanwhile, devices connected with the network in a scene are also considered, so that the effect of excavating the hidden device relation of the current scene as far as possible is achieved.

The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents and improvements made within the spirit and principle of the present invention are intended to be included within the scope of the present invention.

Claims

1. A Wi-Fi based real-time social relationship discovery system, comprising:

2. The method of claim 1, wherein the Wi-Fi data collection module comprises: the wireless network card is enabled to work in a monitoring mode to capture frame data under a wireless network environment, wherein the frame data comprises a control frame, a management frame and a data frame, and the frame data is analyzed to extract effective information.

3. The method of claim 2, wherein the Wi-Fi based real-time social relationship discovery system is implemented as one of: the effective information comprises the MAC address of the equipment, the MAC address of the AP, the encryption mode of the AP, the SSID requested by the equipment and the MAC address of the equipment responded by the AP.

4. The method of claim 2, wherein the Wi-Fi based real-time social relationship discovery system is implemented as one of: random MAC needs to be identified and filtered out in the collection process, so that the efficiency is improved.

5. The method of claim 1, wherein the Wi-Fi based real-time social relationship discovery system is implemented as one of: and (4) using a classifier to realize AP encryption mode training.

6. The method of claim 1, wherein the Wi-Fi based real-time social relationship discovery system is implemented as one of: in the classification module, the acquired equipment information is a currently known SSID list, and DB-SCAN is used as a classification method.

7. The method of claim 1, wherein the Wi-Fi based real-time social relationship discovery system is implemented as one of: and in the figure relation calculation module, a Psim-q method is adopted to calculate the similarity of the SSID list.

8. The method of claim 1, wherein the Wi-Fi based real-time social relationship discovery system is implemented as one of: the sending module also provides a traceless interrupt function, and executes interrupt operation in the time which can not be perceived by the user to trigger the device to scan the network again, so that the device can answer the played SSID.