CN109600751B - A pseudo base station detection method based on network side user data - Google Patents

Abstract

The invention discloses a pseudo base station detection method based on user data on the network side. The URL is filtered to obtain the abnormal URL; for any abnormal URL, its traffic threshold is obtained, and the base station whose traffic volume of the abnormal URL is greater than the traffic threshold within the target time interval is determined as the abnormal base station, so as to obtain the corresponding abnormal URL. For any abnormal URL, if the corresponding abnormal base station set is not empty, the abnormal URL is determined to be a malicious URL, and the abnormal base station set is divided so that geographically adjacent abnormal base stations belong to the same abnormal base station. A subset of abnormal base stations to obtain the active area of pseudo base stations. The present invention can accurately obtain multiple active areas of the pseudo base station without relying on the user of the mobile terminal.

Description

A pseudo base station detection method based on network side user data

technical field

The invention belongs to the field of mobile Internet network security, and more particularly, relates to a pseudo base station detection method based on network side user data.

Background technique

The fake base station can use the one-way authentication mechanism that the mobile phone cannot identify the base station to obtain the mobile phone card information, and force the group to send spam text messages to the mobile phone. In the mobile Internet, fake base stations are one of the main ways to spread malicious URLs (Uniform Resource Locator, Uniform Resource Locator), because the number of spam text messages sent by fake base stations can be changed at will, and phishing URLs with financial fraud properties often use 95555 , 95588, 10086 and other netizens prevent the spread of common service official numbers with low psychology, and users are often easily deceived and suffer economic and property losses. Moreover, the pseudo base station has the characteristics of liquidity, which can efficiently realize the sending of short messages, and has the characteristics of low investment and high return. The data pipeline port detects the fake base station, which can effectively reduce the damage to netizens caused by malicious URL links in the group text messages sent from the fake base station.

The communication operator cannot obtain the data of the mobile terminal, and can only use the user data on the network side to monitor the pseudo base station. The current methods for detecting pseudo base stations mainly include: based on signaling interaction data and terminal APP data detection. The signaling-based interaction method is mainly observed from the location update signaling on the mobile network side. The mobile phone that has been forcibly registered initiates a location update from a source LAC (Location Area Code, location area code) to a LAC on the current network. . The source LAC is also the LAC of the pseudo base station, and whether it is a pseudo base station can be preliminarily determined according to the source LAC. This method can only achieve the approximate location information of a single pseudo base station, but cannot track multiple pseudo base stations in real time. The method based on the terminal APP data mainly locates the pseudo base station precisely through the mobile terminal information, that is, by analyzing the SMS-related data such as the sending number, the new LAC location, etc., and comparing the information with the data in the database to detect whether it is a pseudo base station, and then The location of the pseudo base station is estimated by returning the location information of the user receiving the spam short message. This method needs to enable mobile phone positioning, which will bring loss of traffic and power to the mobile phone, and at the same time, it is impossible to perceive the geographic activity trajectory of the pseudo base station in a large area.

In general, the existing methods for detecting pseudo base stations cannot accurately obtain the active area of pseudo base stations without relying on mobile terminal users, which is not conducive to communication operators' real-time and effective tracking of pseudo base stations.

SUMMARY OF THE INVENTION

In view of the defects and improvement requirements of the prior art, the present invention provides a pseudo base station detection method based on network side user data, the purpose of which is to accurately obtain the active areas of multiple pseudo base stations without relying on mobile terminal users.

In order to achieve the above object, according to an aspect of the present invention, a method for detecting a pseudo base station based on user data on the network side is provided, comprising the following steps:

(1) parse out the URL and the corresponding access information from the HTTP request data of multiple users of the mobile Internet, and filter the parsed URL according to the domain name whitelist of the current network, thereby obtaining the abnormal URL;

(2) For any abnormal URL, obtain its access threshold, and determine the base station whose access to the abnormal URL is greater than the access threshold within the target time interval as the abnormal base station, thereby obtaining the abnormal base station set corresponding to the abnormal URL;

(3) For any abnormal URL, if the corresponding abnormal base station set is not empty, it is determined that the abnormal URL is a malicious URL, and the abnormal base station set is divided so that the adjacent abnormal base stations in geographic location belong to the same abnormality Subset of base stations, so as to obtain the activity range of pseudo base stations;

The traffic threshold is the dividing point between the abnormal base station and the non-abnormal base station for URL traffic, and the start time of the target time interval is the time when the corresponding abnormal URL is detected for the first time.

According to a large amount of statistical information, it is found that after receiving spam messages with malicious URL links sent by pseudo base station equipment, mobile terminal users will access the malicious URL links through HTTP requests within a certain period of time; many victim users are operating correspondingly. The HTTP request initiated by the business base station coverage area for the URL link will present the characteristics of intensive access by multiple users in the local area, and sparse or even non-existent access in the surrounding area. The present invention utilizes the above-mentioned features to count the number of visits of each base station accessing abnormal URLs within the target time interval, and compare it with the threshold value of the visits, thereby identifying malicious URLs and the corresponding set of abnormal base stations. The abnormal base stations that are adjacent in position are divided into the same subset of abnormal base stations, so that multiple active areas of pseudo base stations can be obtained accurately and effectively.

The target time interval is specifically set according to the behavior characteristics of the pseudo base station sending spam short messages and the behavior characteristics of the user accessing the connection in the short message, so as to ensure that the acquired data can accurately reflect whether the base station has dense access characteristics, so as to accurately identify abnormal base stations and improve the Accuracy of fake base station detection.

Further, in step (3), the method for dividing the abnormal base station set into abnormal base station subsets includes:

Obtain the latitude and longitude of each abnormal base station in the set of abnormal base stations, and calculate the distance between any two abnormal base stations;

If the distance between the first abnormal base station and the second abnormal base station is less than the distance threshold, it is determined that the first abnormal base station and the second abnormal base station are geographically adjacent;

If the first abnormal base station and the second abnormal base station are geographically adjacent to the third abnormal base station respectively, it is determined that the first abnormal base station and the second abnormal base station are geographically adjacent;

Divide the geographically adjacent abnormal base stations into the same subset of abnormal base stations;

The first abnormal base station, the second abnormal base station and the third abnormal base station are different abnormal base stations corresponding to the same malicious URL.

Further, the calculation method of the access threshold value includes:

For any abnormal URL, obtain the identification code of each abnormal base station in the corresponding abnormal base station set and the number of visits to the abnormal URL within the target time interval, and then calculate the interquartile range;

The traffic threshold is calculated based on the first and third quantiles of the interquartile range.

Further, the calculation formula of the traffic threshold is:

Th _u =Q3+1.5*(Q3-Q1);

Among them, _Thu represents the threshold of visits, and Q1 and Q3 represent the first and third quantiles of the interquartile range, respectively.

In general, through the above technical solutions conceived by the present invention, the following beneficial effects can be achieved:

(1) The pseudo base station detection method based on network side user data provided by the present invention obtains URL and corresponding access information by parsing the HTTP request data on the network side, and counts the number of visits of each base station accessing abnormal URLs in the target time interval, And compared with the traffic threshold, thus identifying malicious URLs and identifying abnormal base stations. On the one hand, the method only uses the user data on the network side to complete the detection of the pseudo base station, and does not need to rely on the mobile terminal user; activity area.

(2) The pseudo base station detection method based on the user data on the network side provided by the present invention can accurately obtain the active area of the pseudo base station by adding geographically adjacent pseudo base stations to the same pseudo base station set, which is beneficial to communication operations The quotient detects the pseudo base station with liquidity in real time.

Description of drawings

1 is a schematic diagram of an existing pseudo base station sending a malicious URL to a terminal user through a short message;

FIG. 2 is a flowchart of a method for detecting a pseudo base station based on user data on a network side according to an embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

Figure 1 shows a schematic diagram of a pseudo base station sending a malicious URL to an end user through a short message. In simple terms, the pseudo base station sends a spam short message carrying a malicious URL link to the user, and the user accesses the malicious URL link carried in the short message through the operator's base station , the pseudo base station itself cannot be detected, and only the detected base station can determine the active area of the pseudo base station. In order to obtain the activity range of the pseudo base station, the pseudo base station detection method based on the network side user data provided by the present invention directly parses the URL from the HTTP request data of the network side user accessing the network. If it is high and involves the characteristics that the base stations are adjacent to each other in a band shape, it is judged as pseudo base station data.

Specifically, the method for detecting a pseudo base station based on user data on the network side provided by the present invention is shown in FIG. 2 , and includes the following steps:

(1) parse out the URL and the corresponding access information from the HTTP request data of multiple users of the mobile Internet, and filter the parsed URL according to the domain name whitelist of the current network, thereby obtaining the abnormal URL;

The access information corresponding to the URL includes the user identifier, the base station identifier of the access base station, and the access timestamp;

Since the URL contains domain name information, after extracting the URL and filtering according to the whitelist of the current network, the normal URL can be filtered out and the abnormal URL can be obtained;

(2) for any abnormal URL, obtain its access threshold value, and determine the base station whose access volume to the abnormal URL is greater than the access volume threshold value within the target time interval as the abnormal base station, thereby obtaining the abnormal base station combination corresponding to the abnormal URL;

The starting time of the target time interval is the time when the corresponding abnormal URL is detected for the first time. The target time interval is specifically set according to the behavior characteristics of the pseudo base station sending spam short messages and the behavior characteristics of the user accessing the connection in the short message, so as to ensure the obtained The data can accurately reflect whether the base station has dense access characteristics, so as to accurately identify abnormal base stations, thereby improving the accuracy of fake base station detection; related research shows that generally the stay time of a fake base station in a geographical location is about an hour, and it may be turned around for more than one day. At the same time, users will check most of the received short messages within 2 hours; considering these two indicators and combining with specific application scenarios, the specific selection of the target time interval can be determined through simple comparison and verification. value;

The access volume threshold is the dividing point between the abnormal base station and the non-abnormal base station on the URL access volume. In an optional embodiment, the calculation method of the access volume threshold includes:

For any abnormal URL, obtain the identification code of each abnormal base station in the corresponding abnormal base station set and the number of visits to the abnormal URL within the target time interval, and then calculate the quartile range; 1st quantile and 3rd quantile to calculate the traffic threshold;

Specifically, according to the ID of each base station accessing the abnormal URL and the corresponding access volume within the target time interval, a set of aggregate data in the form of {bsid1:34,bsid2:89:bsid3:283,...} can be obtained. , each element represents the ID of the base station accessing the abnormal URL and the corresponding access volume. For example, the first element "bsid1:34" indicates that the base station ID of the base station is bsid1, and the corresponding access volume is 34; Sort the elements in the set data, and take each element as a sample, you can get the number of samples, mean, standard deviation, minimum value, maximum value, and 3 quartiles of the data set, and 25% and 50% of the data. and the number of the 75% position; when calculating the interquartile range, the relevant functions of the pandas library can be used to complete the specific calculation;

In this embodiment, the calculation formula of the access threshold is specifically:

Th _u =Q3+1.5*(Q3-Q1);

Among them, T _u represents the threshold of traffic volume, and Q1 and Q3 represent the first and third quantiles of the interquartile range, respectively;

According to the theory of statistics, using the above method to calculate the threshold of the traffic volume can effectively detect the abnormal base station that has abnormal access to any abnormal URL;

(3) For any abnormal URL, if the corresponding abnormal base station set is not empty, it is determined that the abnormal URL is a malicious URL, and the abnormal base station set is divided so that the adjacent abnormal base stations in geographic location belong to the same abnormality Subset of base stations, so as to obtain the activity range of pseudo base stations;

In an optional embodiment, the method for dividing the abnormal base station set into abnormal base station subsets includes:

Obtain the latitude and longitude of each abnormal base station in the set of abnormal base stations, and calculate the distance between any two abnormal base stations;

If the distance between the first abnormal base station and the second abnormal base station is less than the distance threshold, it is determined that the first abnormal base station and the second abnormal base station are geographically adjacent;

If the first abnormal base station and the second abnormal base station are geographically adjacent to the third abnormal base station respectively, it is determined that the first abnormal base station and the second abnormal base station are geographically adjacent;

Divide the geographically adjacent abnormal base stations into the same subset of abnormal base stations;

Wherein, the first abnormal base station, the second abnormal base station and the third abnormal base station are different abnormal base stations corresponding to the same malicious URL;

和

且经度差为Δλ的两个异常基站，可采用如下公式计算这两个伪基站之间的距离d：In the above method of judging that the abnormal base stations are adjacent in the ground, the latitudes are respectively

and

For two abnormal base stations whose longitude difference is Δλ, the following formula can be used to calculate the distance d between the two pseudo base stations:

In the above calculation formula, R represents the radius of the earth;

Based on the above determination method, even if the distance between the abnormal base stations A and C is greater than the distance threshold, but the abnormal base station A is adjacent to the abnormal base station B, and the abnormal base station C is adjacent to the abnormal base station B, the abnormal base station A and the abnormal base station C are still determined. Adjacent, abnormal base stations A, B and C belong to the same abnormal base station subset;

The distance threshold is set according to the distance between base stations in the actual environment to ensure that the active range of the pseudo base station can be accurately obtained; according to the basic knowledge of base stations, it can be known that the distance between base stations is generally within the range of (300, 1000) meters. Single-step tuning method, that is, traversing the value of (30,1000), and comparing the number of malicious URL detections obtained by selecting different distance thresholds with the manual judgment, the closest value to the manual verification value is the most. optimal distance threshold.

According to a large amount of statistical information, it is found that after receiving spam messages with malicious URL links sent by pseudo base station equipment, mobile terminal users will access the malicious URL links through HTTP requests within a certain period of time; many victim users are operating correspondingly. The HTTP request initiated by the business base station coverage area for the URL link will present the characteristics of intensive access by multiple users in the local area, and sparse or even non-existent access in the surrounding area. The present invention utilizes the above features to count the number of visits of each base station accessing abnormal URLs within the target time interval, and compare it with the threshold of the visit volume, thereby identifying malicious URLs and further identifying fake base stations, and can accurately and effectively determine fake URLs. Multiple active areas of the base station.

Those skilled in the art can easily understand that the above are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention, etc., All should be included within the protection scope of the present invention.

Claims (2)

1. a pseudo base station detection method based on network side user data, is characterized in that, comprises the steps: (1) parse out the URL and the corresponding access information from the HTTP request data of multiple users of the mobile Internet, and filter the parsed URL according to the domain name whitelist of the current network, thereby obtaining the abnormal URL; (2) For any abnormal URL, obtain its access volume threshold, and determine the base station whose access volume of the abnormal URL is greater than the access volume threshold within the target time interval as the abnormal base station, so as to obtain the abnormal base station corresponding to the abnormal URL gather; The method for calculating the access threshold value comprises: for any abnormal URL, obtaining the identification code of each abnormal base station in the corresponding abnormal base station set and the access volume of the abnormal URL within the target time interval, and calculating Interquartile range; calculating the traffic threshold according to the first quantile and the third quantile of the interquartile range; (3) For any abnormal URL, if the corresponding abnormal base station set is not empty, the abnormal URL is determined to be a malicious URL, and the abnormal base station set is divided so that the abnormal base stations adjacent to the geographical location belong to the same abnormal base station. A subset of abnormal base stations to obtain the active area of pseudo base stations; In the step (3), the method for dividing the abnormal base station set into abnormal base station subsets includes: Obtain the longitude and latitude of each abnormal base station in the set of abnormal base stations, and thereby calculate the distance between any two abnormal base stations; If the distance between the first abnormal base station and the second abnormal base station is less than the distance threshold, it is determined that the first abnormal base station and the second abnormal base station are geographically adjacent; If the first abnormal base station and the second abnormal base station are geographically adjacent to the third abnormal base station respectively, it is determined that the first abnormal base station and the second abnormal base station are geographically adjacent; The abnormal base stations adjacent to the geographical location are divided into the same abnormal base station subset; wherein, the access threshold is the demarcation point between the abnormal base station and the non-abnormal base station to the URL access volume, and the starting moment of the target time interval is The moment when the corresponding abnormal URL is detected for the first time; the first abnormal base station, the second abnormal base station and the third abnormal base station are different abnormal base stations corresponding to the same malicious URL. 2. The pseudo base station detection method based on network side user data as claimed in claim 1, wherein the calculation formula of the access threshold is: Th _u =Q3+1.5*(Q3-Q1); Wherein, T _u represents the traffic threshold, and Q1 and Q3 represent the first quantile and the third quantile of the interquartile range, respectively.

Images