CN108134780A - Based on the smart home security device security judgment method for improving decision Tree algorithms - Google Patents

Abstract

The invention relates to a method for judging the safety of smart home security equipment based on an improved decision tree algorithm, which belongs to the technical field of network information security of smart home security equipment. The method of the invention captures Pcap data packets, analyzes the data packets, trains a decision tree model, extracts control command data, forges transmission data, realizes the control of the smart home security equipment, and then judges whether it is safe. The modeling of the present invention makes full use of mainstream smart home security equipment on the market, and can provide reliable technical support for consumers to judge the safety of intelligent security equipment appearing on the market.

Description

Safety Judgment Method for Smart Home Security Equipment Based on Improved Decision Tree Algorithm

technical field

The invention belongs to the technical field of network information security of smart home security equipment, and relates to a security judgment method for smart home security equipment based on an improved decision tree algorithm.

Background technique

In recent years, with the rapid development of the Internet of Things, smart home and smart security are also deeply loved by consumers. In order to meet the needs of various consumer groups, smart home products are also various, and some of them have reduced product quality in order to reduce costs. After investigation, there are many unencrypted smart security products in the market, resulting in insufficient security of smart security equipment and unable to provide strong protection for consumers.

Contents of the invention

In view of this, the purpose of the present invention is to provide a security judgment method for smart home security equipment based on an improved decision tree algorithm, which can identify the security of intelligent security equipment and provide good help for users to choose products.

To achieve the above object, the present invention provides the following technical solutions:

A method for judging the safety of smart home security equipment based on an improved decision tree algorithm, the method includes the following steps:

S1: Build a wifi environment, and obtain the Pcap data packet of the smart home security device controlled by the mobile phone by controlling the smart home security device;

S2: Analyze the data carried in the TCP protocol of the transport layer in the captured Pcap data packet, and filter the Pcap data packet;

S3: Generate the training set and test set of the decision tree according to the obtained and analyzed results;

S4: Use the training set to train the decision tree model, and use the test set to test the decision tree model to determine the improved decision tree model;

S5: Use the trained improved decision tree model to judge whether the control command data in the Pcap data packet is encrypted. If it is encrypted, it is judged that the security of the smart home security device is high. If it is not encrypted, it is judged that the security of the smart home security device is high. Low.

Further, step S1 specifically includes the following steps:

S11: Turn on the wifi hotspot through the personal computer;

S12: Connect both the mobile phone and the smart security device to the wifi hotspot;

S13: Log in to the APP through the mobile phone to arm or disarm the smart security device, and open the wireshark software to capture pcap data packets.

Further, in step S13, the smart home security device can be selected and controlled according to needs during the capturing process, while ensuring that the capturing time is greater than 20 minutes.

Further, step S2 specifically includes the following steps:

S21: filter out non-TCP protocol data frames in the Pcap data packet;

S22: judging whether the data bit length in the TCP protocol data frame is greater than 0, and filtering out the data frames whose data bit length is less than or equal to 0;

S23: Obtain the timestamp in the Pcap data packet, calculate the time difference between two similar frames, and filter out the data frames whose time difference is not fixed;

S24: Analyze the remaining data frames of the Pcap data packet, and record the IP and the corresponding data bit length.

Further, step S4 specifically includes the following steps:

S41: Assume that the total number of samples in the training set and the test set is N, and each sample contains M feature attributes;

S42: Randomly select N1 samples from N samples as a training set, and the remaining N-N1 samples are used as a test set;

S43: Generate a decision tree T according to the N1 samples of the training set;

S44: Judge the accuracy of the decision tree T from the N-N1 samples of the remaining test set, if it can be judged accurately, then output the decision tree T as a decision tree model, if it cannot be judged accurately, then compare the error data with the same amount of training set Replace the samples to form a new test set and training set, and repeat step S43 until the decision tree T can be accurately judged.

Further, step S5 specifically includes the following steps:

S51: Obtain the control command data in the Pcap data packet twice in a row;

S52: comparing the control command data captured twice by performing character string matching on the control command data captured twice;

S53: If the number of bytes of the two control command data compared with the data bit change is less than 10 bytes, and the smart home security device can be controlled by forging the TCP data through the personal computer, it is judged as non-encrypted and the security is low;

If the number of bytes changed by comparing the data bits of the two control command data is greater than or equal to 10 bytes, and the smart home security device cannot be controlled by forging TCP data through a personal computer, it is judged to be encrypted and has high security.

The beneficial effect of the present invention is that: on the one hand, the method of the present invention can help consumers to accurately judge the safety of smart home security equipment on the market, and on the other hand, can also provide technical support for specific government departments to supervise the smart home market.

Description of drawings

In order to make the purpose, technical scheme and beneficial effect of the present invention clearer, the present invention provides the following drawings for illustration:

Fig. 1 is a flowchart of the present invention;

Fig. 2 is the schematic diagram of the Pcap packet filtered by IP;

Fig. 3 is the schematic diagram of the basic format of the captured Pcap file;

Figure 4 is a diagram of an improved decision tree model for extracting control commands of smart home security equipment.

Detailed ways

The preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

The present invention judges the safety of the device according to the control command of the smart home security device acquired in the wifi environment. The control commands of smart home security equipment are directly related to the brand of smart home security equipment, and it is necessary to obtain its control commands to judge whether the brand is worth buying.

Below in conjunction with accompanying drawing and specific embodiment the present invention will be further described:

A security identification method for smart home security equipment based on an improved decision tree algorithm. Figure 1 is a flow chart of the entire recognition method.

1. Capture the Pcap data packets of smart home security devices in the wifi environment.

2. Filter Pcap data packets to determine which smart home security devices exist in this environment.

3. Establish a decision tree model to analyze and identify the Pcap data packet

Turn on the wifi hotspot on the personal computer to simulate the router, connect the mobile phone, computer and smart security equipment to the wifi hotspot, log in the APP of Kerui, Xiaomi and other smart security equipment with the mobile phone, arm or disarm the device, and open wireshark The software captures the data packets. During the capture process, it chooses to control the smart home security equipment according to the needs, and at the same time ensures that the capture time is more than 20 minutes, and classifies the captured data packets according to the training set and test set of the decision tree model. .

According to the IP connected to the router, and according to the characteristics of the smart home security device interacting with the server regularly, then determine which IP is the IP of the smart home security device. as shown in picture 2. It clearly shows the heartbeat data of the device, that is, it is sent repeatedly and the data bit length is greater than 0.

According to the structure of the Pcap packet, as shown in Figure 3. It is necessary to find the time stamp carried in each data packet according to the Pcap structure, and find the heartbeat time of each corresponding smart home security device.

Establish a decision tree model based on the captured data, and analyze whether the Pcap packet contains corresponding control commands, as shown in Figure 4. The decision tree model is a binary tree model, the total duration of the Pcap file is the difference between the first frame and the last frame timestamp of the Pcap file; the transport layer protocol and frame data size (Frame_Data_size) is the time stamp of each frame in the Pcap file Transmission protocol and data frame size; after the above decision filtering, extract the time stamp of each frame, classify according to the IP address, calculate the time stamp difference, find the source IP and destination IP with a fixed time stamp difference; combine the source IP and The destination IP is swapped, looking for the data frame containing information in the data packet, and then judging whether it is a control command according to whether the data information contained is too much repetition.

In the initial state, software filtering and classification are performed on the Pcap data packets obtained by wireshark; the decision tree algorithm model is trained with the training set, and then the trained decision tree is verified with the test set. The training set is obtained by testing a variety of mainstream products in the market (EZVIZ, Kerui, Xiaomi, etc.), trains the decision tree model, and uses the data packets of related series of products as the test set to test the accuracy of the decision tree, and then compares them according to The error-adjusted decision tree algorithm selects the one with the highest accuracy as the final decision tree. The specific steps of the improved algorithm are described as follows:

1) Suppose there are N samples, and each sample contains M characteristic attributes;

2) Randomly select N1 samples from N samples as a training set, and the remaining N-N1 samples are used as a test set;

3) Generate a decision tree T according to the N sample training set;

4) According to the N-N1 sample test set, judge the accuracy of the decision tree T, if it can be judged accurately, then output the decision tree model, if not, you need to replace these error data with the same amount of training set samples , form a new test set and training set, go to step 3) until the decision tree T can be judged accurately.

According to the analysis of the Pcap file structure, the data analysis of the intelligent security equipment and the capture of the Pcap data packet in the specific environment of the smart home, a decision tree algorithm model can be established to find out whether there is a Pcap data packet in the captured Pcap data packet. If there is an intelligent security device, find out its control command according to the characteristics of the intelligent security device, so as to judge whether its security is high or low. The control commands of the intelligent security device include arming and disarming. The judgment of equipment security is based on whether the data is encrypted or not, and judging whether the data is encrypted is the judgment of the complexity of the data. The method adopted in the present invention is to obtain two control commands continuously, and compare the two data through a comparison function. If the number of bytes of the data bit change in the second comparison is less than 10 bytes, and the control can be realized by forging TCP data by computer, then it is judged as non-encrypted, and the security is low; otherwise, it is judged as encrypted, and the security is high.

Finally, it is noted that the above preferred embodiments are only used to illustrate the technical solutions of the invention and not limit them. Although the present invention has been described in detail through the above preferred embodiments, those skilled in the art should understand that it may be possible in form and details. Various changes can be made to it without departing from the scope defined by the claims of the present invention.

Claims (6)

1. A method for judging the safety of smart home security equipment based on an improved decision tree algorithm, characterized in that: the method comprises the following steps: S1: Build a wifi environment, and obtain the Pcap data packet of the smart home security device controlled by the mobile phone by controlling the smart home security device; S2: Analyze the data carried in the TCP protocol of the transport layer in the captured Pcap data packet, and filter the Pcap data packet; S3: Generate the training set and test set of the decision tree according to the obtained and analyzed results; S4: Use the training set to train the decision tree model, and use the test set to test the decision tree model to determine the improved decision tree model; S5: Use the trained improved decision tree model to judge whether the control command data in the Pcap data packet is encrypted. If it is encrypted, it is judged that the security of the smart home security device is high. If it is not encrypted, it is judged that the security of the smart home security device is high. Low. 2. The method for judging the safety of smart home security equipment based on the improved decision tree algorithm according to claim 1, wherein: step S1 specifically comprises the following steps: S11: Turn on the wifi hotspot through the personal computer; S12: Connect both the mobile phone and the smart security device to the wifi hotspot; S13: Log in to the APP through the mobile phone to arm or disarm the smart security device, and open the wireshark software to capture pcap data packets. 3. The method for judging the safety of smart home security equipment based on the improved decision tree algorithm according to claim 2, characterized in that: in step S13, the smart home security equipment can be selected and controlled according to needs during the capture process, while ensuring the quality of the capture. The time is greater than 20 minutes. 4. The method for judging the safety of smart home security equipment based on the improved decision tree algorithm according to claim 2, wherein: step S2 specifically comprises the following steps: S21: filter out non-TCP protocol data frames in the Pcap data packet; S22: judging whether the data bit length in the TCP protocol data frame is greater than 0, and filtering out the data frames whose data bit length is less than or equal to 0; S23: Obtain the timestamp in the Pcap data packet, calculate the time difference between two similar frames, and filter out the data frames whose time difference is not fixed; S24: Analyze the remaining data frames of the Pcap data packet, and record the IP and the corresponding data bit length. 5. The method for judging the safety of smart home security equipment based on the improved decision tree algorithm according to claim 4, wherein: step S4 specifically comprises the following steps: S41: Assume that the total number of samples in the training set and the test set is N, and each sample contains M feature attributes; S42: Randomly select N1 samples from N samples as a training set, and the remaining N-N1 samples are used as a test set; S43: Generate a decision tree T according to the N1 samples of the training set; S44: Judge the accuracy of the decision tree T from the N-N1 samples of the remaining test set, if it can be judged accurately, then output the decision tree T as a decision tree model, if it cannot be judged accurately, then compare the error data with the same amount of training set Replace the samples to form a new test set and training set, and repeat step S43 until the decision tree T can be accurately judged. 6. The method for judging the safety of smart home security equipment based on the improved decision tree algorithm according to claim 5, wherein step S5 specifically includes the following steps: S51: Obtain the control command data in the Pcap data packet twice in a row; S52: comparing the control command data captured twice by performing character string matching on the control command data captured twice; S53: If the number of bytes of the two control command data compared with the data bit change is less than 10 bytes, and the smart home security device can be controlled by forging the TCP data through the personal computer, it is judged as non-encrypted and the security is low; If the number of bytes changed by comparing the data bits of the two control command data is greater than or equal to 10 bytes, and the smart home security device cannot be controlled by forging TCP data through a personal computer, it is judged to be encrypted and has high security.