KR102182675B1 - Wireless device identification method and system using machine learning - Google Patents

Abstract

The present invention relates to a wireless terminal identification method and system using machine learning for identifying a terminal authorized by an administrator, a terminal unauthorized, and a MAC spoofing terminal by extracting a feature value from a probe request packet of a wireless terminal by using machine learning. According to one embodiment of the present invention, the wireless terminal identification method using machine learning may comprise: a step (S10) of collecting a probe request transmitted by nearby terminals and generating a pcapng file; a step (S20) of converting the generated pcapng file into a CSV file; and a step (S30) of extracting a feature value for identifying a wireless terminal in a wireless communication environment by using the converted CSV file. In addition, the method may comprise: a step (S40) of calculating and extracting a feature value from the probe request of a previously stored terminal based on the feature value for identifying the extracted terminal; a step (S50) of generating a white list by adding an identifier to the feature value calculated and extracted in the step (S40); a step (S60) of determining whether a MAC address of a terminal to be identified exists in the white list; and a step (S70) of determining an authorized terminal and a MAC spoofing terminal by using the extracted feature value if the MAC address exists in the white list as a result of the determination in the step (S60).

Description

Wireless device identification method and system using machine learning

The present invention relates to a wireless terminal identification method and system using machine learning, and by extracting a feature value from a probe request packet of a wireless terminal using machine learning, a terminal authorized by an administrator, a terminal that is not authorized, and a MAC It relates to a wireless terminal identification method and system using machine learning to identify a MAC Spoofing terminal.

Wireless network technology has been continuously developed, and as the penetration rate of smartphones and IoT devices increases in recent years, the demand for wireless networks is also increasing. However, wireless networks have numerous vulnerabilities, and attack through these vulnerabilities is possible using simple tools.

Typical attacks include MAC Spoofing terminals. The attack using the MAC Spoofing terminal causes great confusion in the network in such a way that an unauthorized terminal infiltrates the internal network by disguised as an authorized terminal.

In order to cope with this MAC spoofing terminal attack, there is a need for a technology capable of quickly and accurately recognizing and identifying the existence of nearby wireless communication devices. However, due to the characteristics of a wireless network for identifying a conventional wireless communication device, it is sensitive to errors, the accuracy is degraded depending on the surrounding environment, and there is a limitation that expensive wireless signal collection equipment is required.

Korean Patent Registration No. 10-1724321 (announced on April 07, 2017)

Accordingly, the technical problem to be achieved by the present invention is to solve the conventional shortcomings, and is a wireless terminal capable of accurately identifying a wireless communication device without being affected by noise and measurement errors caused by changes in the surrounding communication environment. It aims to provide an identification method and system.

In order to achieve this technical problem, a wireless terminal identification method using machine learning according to an aspect of the present invention collects probe requests transmitted from neighboring terminals using a wireless network interface card (NIC) in a feature extraction module, and a pcapng file Generating (S10), converting the pcapng file generated by the feature extraction module into a CSV file (S20), and identifying a wireless terminal in a wireless communication environment using the converted CSV file by the feature extraction module It may include a step (S30) of extracting a feature value for.

In addition, the terminal identification module calculating and extracting a feature value from a probe request of the terminal previously stored based on the feature value for identifying the terminal extracted from the feature extraction module (S40), and the terminal identification module It may include a step (S50) of generating a white list by adding an identifier to the feature values calculated and extracted in step (S40).

In addition, when the terminal identification module determines whether the MAC address of the terminal to be identified exists in the white list (S60) and the determination result of the step (S60), the characteristic It may include a step (S70) of determining an authorized terminal and a MAC spoofing terminal using the feature values extracted from the extraction module.

In addition, the wireless terminal identification system using machine learning according to another aspect of the present invention collects probe requests transmitted by neighboring terminals using a wireless network interface card (NIC), and the collected A feature extraction module that extracts feature values based on information, and a terminal identification module that generates a similarity-based white list using the feature values extracted from the feature extraction module, and identifies wireless terminals using the white list. do.

In addition, the feature extraction module may include a collection unit, a conversion unit, and a feature extraction unit. The collection unit collects probe requests transmitted from nearby terminals using a wireless network interface card, and generates a pcapng file.

The conversion unit converts the generated pcapng file into a CSV file. In addition, the feature extraction unit extracts a feature value for identifying a wireless terminal in a wireless communication environment through the converted CSV file.

In addition, the terminal identification module may include a white list generation unit, a determination unit, a similarity comparison unit and a storage unit. The white list generator calculates and extracts a feature value from a probe request of terminals previously stored in a storage unit based on the feature value extracted by the feature extraction module, and then generates a white list by adding an identifier.

The similarity comparison unit calculates a similarity by comparing the feature value of the wireless terminal to be identified with the feature value of the white list. The determination unit identifies an authorized terminal, an unauthorized terminal, and a MAC spoofing terminal by determining based on the comparison result of the white list and the similarity comparison unit and the similarity calculation result.

As described above, the wireless terminal identification method and system using machine learning according to the present invention can accurately identify a wireless communication device without being affected by noise and measurement errors caused by changes in the surrounding communication environment. There is an effect.

In addition, there is an effect that additional cost can be reduced by identifying a surrounding wireless communication device using a wireless NIC without additional additional equipment. In addition, by extracting feature values using machine learning, there is an effect of reducing the identification time of the wireless terminal and improving the accuracy.

1 is a block diagram showing a wireless terminal identification system using machine learning according to an embodiment of the present invention.
2 is a flowchart illustrating a method of identifying a wireless terminal using machine learning according to an embodiment of the present invention.
3 is a flowchart illustrating a method of identifying a wireless terminal using machine learning according to an embodiment of the present invention.
FIG. 4 is a flowchart illustrating in detail step (S70) of FIG. 3.
5 is a diagram illustrating a process of generating a wireless terminal white list according to an embodiment of the present invention.
6 is a diagram illustrating a wireless terminal identification process according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art may easily implement the present invention. However, the present invention may be implemented in various forms and is not limited to the embodiments described herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part "includes" a certain component, it means that other components may be further included rather than excluding other components unless otherwise stated. In addition, terms such as "... unit", "... group", and "... module" described in the specification mean units that process at least one function or operation, which can be implemented by hardware or software or a combination of hardware and software. I can.

Hereinafter, the present invention will be described in detail by describing a preferred embodiment of the present invention with reference to the accompanying drawings.

The same reference numerals shown in each drawing indicate the same members.

1 is a block diagram showing a wireless terminal identification system 10 using machine learning according to an embodiment of the present invention. The wireless terminal identification system 10 using machine learning according to an embodiment of the present invention includes a feature extraction module 100 for extracting a feature value by collecting and processing wireless packets, and a similarity-based white list 211. And a terminal identification module 200 for identifying a wireless terminal by using.

The feature extraction module 100 may include a collection unit 110, a conversion unit 120, and a feature extraction unit 130. The collection unit 110 collects probe requests transmitted from nearby terminals using a wireless network interface card (NIC), and generates a pcapng (pcap next generation) file.

In addition, the conversion unit 120 converts the generated pcapng file into a CSV file. In addition, the feature extraction unit 130 extracts a feature value for identifying a wireless terminal in a wireless communication environment through the converted CSV file.

In addition, the feature extraction unit 130 includes a sequence number extraction unit 131 for extracting a sequence number increase rate to identify a wireless terminal from the probe request packet, and the probe request. It may include a PRL extraction unit 132 for extracting the length (Length).

That is, the feature extraction unit 130 determines two feature values of a sequence number increase rate and a probe request length in order to identify a wireless terminal as the probe request. It can be extracted from the packet.

In this case, the sequence number increase rate means an increase rate of the sequence number per second, and indicates a slope in the correlation graph between the reception time of the probe request and the sequence number.

The sequence number extracting unit 131 according to the present invention may extract an increase rate of the sequence number using machine learning. Preferably, linear regression can be used to measure the exact slope of the correlation graph.

That is, the sequence number extracting unit 131 according to the present invention calculates the slope of the straight line calculated by repeating linear regression several times in the correlation graph between the reception time of the probe request and the sequence number. Extract with.

In addition, the PRL extractor 132 subtracts the value of the SSID field from the total length of all probe request packets for the wireless terminal to be identified, and calculates a null probe request with an unchanged value. The length of request) is extracted as a feature value.

That is, the length of the null probe request may be calculated as shown in [Equation 1] below.

[Equation 1]

NPRL = PRL-SSIDL

Here, NPRL is the length of a null probe request, PRL is the total length of a probe request packet, and SSIDL is the length of an SSID field.

In addition, the feature extracting unit 130 may further include a MAC extracting unit 133 for extracting an SSID and a MAC address from the collected probe request packet.

In addition, the terminal identification module 200 may include a white list generation unit 210, a determination unit 220, a similarity comparison unit 230, and a storage unit 240. The white list generation unit 210 calculates and extracts a feature value from a probe request of terminals previously stored in the storage unit 240 based on the terminal identification feature value extracted by the feature extraction module 100, and then together with the identifier. Whitelist 211 is created.

That is, the white list generation unit 210 calculates and extracts a feature value from a probe request of terminals previously stored in the storage unit 240, and stores an identifier corresponding to the extracted feature value in the storage unit 240. A white list 211 is created by adding from a probe request of previously stored terminals.

Here, the identifier may be the SSID and MAC address of the wireless terminal. In addition, the determination unit 220 determines whether the MAC address of the terminal to be identified extracted by the MAC extraction unit 133 exists in the white list 211.

If the MAC address of the wireless terminal to be identified does not exist in the white list 211 as a result of the determination of the determination unit 220, it is classified as an unauthorized terminal, and if it exists in the white list 211, feature extraction The feature value extracted by the unit 130 is input to the similarity comparison unit 230.

The similarity comparison unit 230 compares the feature value of the wireless terminal to be identified received from the feature extraction unit 130 with the feature value of the white list 211 generated by the white list generator 210.

In this case, the similarity may be calculated according to a preset similarity criterion based on a feature value for identifying the wireless terminal. That is, the similarity comparison unit 230 according to an embodiment of the present invention may calculate the similarity according to a preset similarity criterion using a sequence number increase rate and a length of a probe request. .

The determination unit 220 compares the identifier of the feature value having the highest similarity in the white list 211 with the identifier of the terminal to be identified based on the comparison result of the similarity comparison unit 230 and the similarity calculation result, and determines whether or not they are identical. , It is determined whether the highest similarity is greater than or equal to a preset threshold.

If both conditions are true as a result of the determination of the determination unit 220, it is classified as an authorized terminal, and if at least one is not satisfied, it is classified as a MAC Spoofing terminal.

The storage unit 240 includes probe request information of the terminal collected through the collection unit 110, feature values extracted through the feature extraction unit 130, and generated by the white list generation unit 210. The white list 211 can be stored. In addition, the storage unit 240 may store a determination result of the determination unit 220, a similarity comparison result calculated by the similarity comparison unit 230, and a similarity calculation result.

As described above, the wireless terminal identification system 10 using machine learning according to an exemplary embodiment of the present invention may identify and display a terminal authorized by an administrator, an unauthorized terminal, and a MAC Spoofing terminal.

2 is a flowchart illustrating a method of identifying a wireless terminal using machine learning according to an embodiment of the present invention, and FIG. 3 is a flowchart illustrating a method of identifying a wireless terminal using machine learning according to an embodiment of the present invention. In addition, FIG. 4 is a flow chart showing in detail step (S70) of FIG. 3. In addition, FIG. 5 is a diagram illustrating a process of generating a wireless terminal white list according to an embodiment of the present invention, and FIG. 6 is a diagram illustrating a process of identifying a wireless terminal according to an embodiment of the present invention.

In the wireless terminal identification method using machine learning according to an embodiment of the present invention, the collection unit 110 collects a probe request transmitted from a neighboring terminal using a wireless network interface card (NIC). And, the step of generating a pcapng (pcap next generation) file (S10), the step of converting the pcapng file generated by the conversion unit 120 to a CSV file (S20), and the feature extraction unit 130 converts the converted CSV file. It may include extracting a feature value for identifying a wireless terminal in a wireless communication environment (S30).

In addition, the whitelist generation unit 210 of the terminal identification module 200 calculates and extracts a feature value from a probe request of the terminal previously stored based on the terminal identification feature value extracted from the feature extraction module 100. Step S40 and the step S50 of generating the white list 211 by adding an identifier to the feature values calculated and extracted by the white list generating unit 210 in step S40.

In addition, the determining unit 220 determines whether the MAC address extracted from the probe request of the terminal to be identified exists in the white list 211 (S60) and the (S60) If the determination result of the step is present in the white list 211, a step (S70) of determining an authorized terminal and a MAC spoofing terminal using the feature values extracted by the feature extraction unit 130 may be included.

At this time, as shown in FIG. 6, if the MAC address of the terminal to be identified does not exist in the white list 211 as a result of the determination in step (S60), the determination unit 220 The step of classifying the terminal as an unauthorized terminal (S61) may be further included.

In addition, in the step (S70) of determining the authorized terminal and the MAC spoofing terminal, the determination unit 220 extracted from the feature extraction unit 130 when the determination result of step (S60) exists in the white list 211 The step of inputting the feature value of the terminal to be identified into the similarity comparison unit 230 (S71), and the similarity comparison unit 230 whitelisting the feature value of the wireless terminal to be identified received from the feature extraction unit 130 A step (S72) of calculating a similarity by comparing the feature values of the white list 211 generated by the generator 210 may be included.

That is, the step (S72) calculates the similarity by comparing the feature value of the white list 211 generated by the white list generating unit 210 with the feature value input from the step (S71), and the terminal of the white list Among them, a terminal having a high similarity to the input feature value is selected.

In this case, the similarity may be calculated according to a preset similarity criterion based on a feature value for identifying the wireless terminal. That is, the similarity comparison unit 230 according to an embodiment of the present invention may calculate the similarity according to a preset similarity criterion using a sequence number increase rate and a length of a probe request. .

In the step of determining the authorized terminal and the MAC spoofing terminal (S70), the determination unit 220 performs a feature value having the highest similarity in the whitelist 211 based on the comparison result of the similarity comparison unit 230 and the similarity calculation result. The step (S73) of comparing the identifier (MAC address) of and the identifier of the terminal to be identified to determine whether they are the same (S73), and the determination unit 220 is the highest in the whitelist 211 of the step (S73). Determining whether the similarity is greater than or equal to a preset threshold (S74), and the determination unit 220 uses the determination results of the steps (S73) and (S74) to perform MAC spoofing (MAC) Spoofing) may include the step of classifying the terminal (S75).

In this case, the step (S75) classifies the terminal to be identified as an authorized terminal when the determination results of the steps (S73) and (S74) are all true as shown in FIG. 6, and the steps (S73) and ( If at least one of the determination results in step S74) is false, the terminal to be identified is classified as a MAC Spoofing terminal.

That is, if the identifier of the feature value with the highest similarity in the white list 211 and the identifier of the terminal to be identified are the same, and the highest similarity in the white list 211 is greater than or equal to a preset threshold, Classify the terminal as an authorized terminal.

For this reason, the wireless terminal identification method and system 10 using machine learning according to an embodiment of the present invention repeats linear regression to extract a sequence number increase rate, thereby accurately performing wireless communication based on a stable extraction result. The terminal can be identified. That is, by using a sequence number, a wireless terminal can be accurately identified without being affected by a loss of a probe request packet or performance of a wireless NIC.

In addition, even when the sequence number increase rate value has a similar value within an error range through an additional feature value such as the length of a probe request, the wireless terminal to be identified is classified and classified. can do.

Therefore, the wireless terminal identification method and system 10 using machine learning according to an embodiment of the present invention detects a MAC Spoofing terminal that forged a conventional identifier, and detects a user-approved authorized terminal and an unauthorized terminal. There is a discernible effect.

Although the preferred embodiments of the present invention have been described above, the present invention is not limited to the above embodiments, and is easily changed from the embodiments of the present invention by those of ordinary skill in the art to which the present invention belongs. It includes all changes to the extent deemed acceptable.

10: wireless terminal identification system 100: feature extraction module
110: collection unit 120: conversion unit
130: feature extraction unit 131: sequence number extraction unit
132: PRL extraction unit 133: MAC extraction unit
200: terminal identification module 210: white list generation unit
211: white list 220: judgment unit
230: similarity comparison unit 240: storage unit

Claims (9)

Collecting probe requests transmitted from neighboring terminals using a wireless network interface card (NIC) in the feature extraction module, and generating a pcapng file (S10);
Converting the pcapng file generated by the feature extraction module into a CSV file (S20);
Extracting a feature value for identifying a wireless terminal in a wireless communication environment using the CSV file converted by the feature extraction module (S30);
A step (S40) of calculating and extracting a feature value from a probe request of a previously stored terminal based on a feature value for identifying the terminal extracted by the feature extraction module by the terminal identification module (S40);
Generating a white list by adding an identifier to the feature value calculated and extracted in the step (S40) by the terminal identification module (S50);
Determining whether the MAC address of the terminal to be identified by the terminal identification module exists in the white list (S60); And
Wireless using machine learning including the step (S70) of determining an authorized terminal and a MAC Spoofing terminal using the feature values extracted from the feature extraction module when the determination result of step (S60) exists in the white list Terminal identification method.
The method of claim 1,
The feature value is a method of identifying a wireless terminal using machine learning including a sequence number increase rate and a length of a probe request.
The method of claim 1,
Classifying the terminal to be identified as an unauthorized terminal when the MAC address of the terminal to be identified does not exist in the white list as a result of the determination in step S60 of determining whether the terminal to be identified exists ( S61) wireless terminal identification method using machine learning further comprising.
The method of claim 1,
The step of determining the authorized terminal and the MAC spoofing terminal (S70)
In the case where it is in the white list as a result of determining whether it exists in the white list (S60), inputting a feature value of the terminal to be identified to the similarity comparison unit (S71),
Computing a similarity by comparing a feature value of the wireless terminal to be identified by the similarity comparison unit with a feature value of a white list (S72),
Comparing the MAC address of the feature value having the highest similarity in the white list with the MAC address of the terminal to be identified based on the comparison result of the similarity comparison unit and the similarity calculation result (S73),
Determining whether the highest similarity degree in the white list is equal to or greater than a preset threshold (S74), and
A method for identifying a wireless terminal using machine learning, comprising the step (S75) of the determination unit classifying an authorized terminal and a MAC Spoofing terminal using the determination result of the (S73) and (S74) steps.
The method of claim 4,
In the step of classifying the authorized terminal and the MAC spoofing terminal (S75), if the determination results of steps (S73) and (S74) are all true, the terminal to be identified is classified as an authorized terminal, and the steps (S73) and ( If at least one of the determination results in step S74) is false, the terminal to be identified is classified as a MAC Spoofing terminal.
A feature extraction module that collects probe requests transmitted from nearby terminals using a wireless network interface card (NIC, Network Interface Card), and extracts feature values based on the collected information;
A wireless terminal identification system using machine learning, comprising: a terminal identification module for generating a similarity-based whitelist using the feature values extracted from the feature extraction module, and identifying the wireless terminal using the whitelist.
The method of claim 6,
The feature extraction module
A collection unit that collects probe requests transmitted from nearby terminals using a wireless network interface card and generates a pcapng file;
A conversion unit converting the generated pcapng file into a CSV file; And
A wireless terminal identification system using machine learning, including a feature extraction unit for extracting a feature value for identifying a wireless terminal in a wireless communication environment through the converted CSV file.
The method of claim 7,
The feature extraction unit
A sequence number extracting unit for extracting a sequence number increase rate to identify a wireless terminal from a probe request packet; and
A wireless terminal identification system using machine learning comprising a PRL extractor for extracting the length of the probe request.
The method of claim 6,
The terminal identification module
A white list generator that calculates and extracts a feature value from a probe request of terminals previously stored in a storage unit based on the feature value extracted by the feature extraction module, and then adds an identifier to generate a white list,
A similarity comparison unit for calculating a similarity by comparing the feature value of the wireless terminal to be identified with the feature value of the white list; and
A wireless terminal identification system using machine learning comprising a determination unit for identifying an authorized terminal, an unauthorized terminal, and a MAC spoofing terminal by determining based on a comparison result of the white list and a similarity comparison unit and a similarity calculation result.

Images