TW202306404A - Detection method for rogue access points, electronic device and readable storage medium - Google Patents

Abstract

A detection method for rogue access points is disclosed. Timestamps of beacon packets of each access point (AP) in multiple wireless AP are collected. Clock skews of each of the APs are calculated based on the collected timestamps. Clock skew models of each of the APs are established according to the clock skews of each of the APs. It is determined whether a rogue AP is detected. A plurality of legal APs adjacent to the rogue AP are selected if the rogue AP is detected. Received signal strength indicator (RSSI) values relative to the rogue AP are collected via the selected legal APs. The rogue AP is localized according to the collected RSSI values.

Description

Detection method of illegal base station, electronic device and computer readable storage medium

The present invention relates to a detection method, and in particular to a detection method of an illegal base station, an electronic device and a computer-readable storage medium.

Rogue Wi-Fi Access Point (AP), referred to as Rogue AP for short, is a Wi-Fi AP set up by malicious attackers without the legal authorization of the enterprise network management unit. Malicious attackers steal important business secrets of enterprises by connecting to illegitimate Wi-Fi APs, causing enterprises to suffer huge business losses. Therefore, enterprise wireless networks must have the ability to detect and suppress rogue Wi-Fi APs in order to ensure the security of enterprise wireless networks.

At present, enterprise-level wireless network equipment mainly uses active scanning (Active Scanning) and passive scanning (Passive Scanning) methods to detect illegal Wi-Fi APs, but cannot detect the media access control (Media Access Control (MAC) addresses of rogue Wi-Fi APs, and there is also a lack of relevant mechanisms for locating the location of rogue Wi-Fi APs.

In view of this, the present invention provides a method for detecting an illegal base station, an electronic device and a storage medium, which can quickly detect and locate an illegal wireless base station (Wi-Fi AP).

An embodiment of the present invention provides a method for detecting an illegal base station, which is applied to an electronic device, and includes the following steps: collecting a time stamp of a beacon (Beacon) packet of each of a plurality of wireless base stations (APs); The collected time stamp calculates the clock offset of each AP; establishes the clock offset model of each AP according to the clock offset of each AP; judges whether an illegal AP is detected; if detected The rogue AP selects a plurality of legitimate APs adjacent to the illegitimate AP; the selected legitimate APs collect received signal strength indicators (Received Signal Strength Indicator, RSSI) values relative to the illegitimate AP; and according to the collected The RSSI value locates the rogue AP.

The embodiment of the present invention also provides an electronic device, including: a processing module, used to collect the time stamp of the Beacon packet of each AP in a plurality of APs, and calculate the clock offset of each AP according to the collected time stamp , and establish the clock offset model of each AP according to the clock offset of each AP; a detection module is used to determine whether an illegal AP is detected, and if the illegal AP is detected, select A plurality of legitimate APs adjacent to the rogue AP, and causing the selected legitimate APs to collect RSSI values relative to the rogue AP; and a positioning module for locating the rogue AP according to the collected RSSI values.

An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed, the steps of the aforementioned method for detecting an illegal base station are implemented.

The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments, but not as a limitation of the present invention.

In order to more clearly understand the above objects, features and advantages of the present invention, the present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that, in the case of no conflict, the embodiments of the present application and the features in the embodiments can be combined with each other.

Many specific details are set forth in the following description to facilitate a full understanding of the present invention, and the described embodiments are only some of the embodiments of the present invention, rather than all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the technical field of the invention. The terms used herein in the description of the present invention are for the purpose of describing specific embodiments only, and are not intended to limit the present invention.

It should be noted that the descriptions involving "first", "second", etc. in the present invention are only for descriptive purposes, and should not be understood as indicating or implying their relative importance or implicitly indicating the number of indicated technical features . Thus, the features defined as "first" and "second" may explicitly or implicitly include at least one of these features. In addition, the technical solutions of the various embodiments can be combined with each other, but it must be based on the realization of those skilled in the art. When the combination of technical solutions is contradictory or cannot be realized, it should be considered that the combination of technical solutions does not exist , nor within the scope of protection required by the present invention.

The field of the timestamp (Timestamp) of the beacon (Beacon) packet of the wireless base station (Wi-Fi Access Point, Wi-Fi AP) records the time when the Beacon packet was transmitted, which is determined by the radio frequency of the Wi-Fi AP (Radio Frequency, RF) chips are directly written into the Beacon packet, regardless of the delay of the Media Access Control (MAC) layer. The Wi-Fi AP clock (Clock) is generated by an oscillator (Oscillator) and a counter (Counter).

Devices with the same hardware components will also have different clock skew (Clock Skew). The cause of the clock offset is the inconsistency of the oscillation frequency of the quartz oscillator of the electronic clock, and it will become larger as the device's power-on time increases.

Through the detection method of illegal base stations in the embodiment of the present invention, the wireless intrusion detection node (Wireless Intrusion Detector) receives all Beacon packets on all wireless transmission channels (Channel), and records the time stamp in the Beacon packet of each AP , to establish the clock offset model of each AP. By continuously updating the clock skew model of each AP, if an abnormal clock skew model is found, it can be determined that the AP corresponding to the abnormal clock skew model is an illegal AP.

FIG. 1 is a flow chart of the steps of the method for detecting an illegal base station according to an embodiment of the present invention, which is applied to a microcontroller of an electronic device. According to different requirements, the order of the steps in the flowchart can be changed, and some steps can be omitted.

Step S11, collecting the time stamp of each AP's Beacon packet.

The wireless intrusion detection device (Wireless Intrusion Detector) scans each wireless transmission channel, and records the time stamp of the Beacon packet of each AP detected, for example, T ₀ , T ₁ , T ₂ ..., and calculates the time stamp of each Beacon packet The time difference value, for example, _Xi = T _i - T ₀ , is used as a database for building the clock offset model of each AP.

Step S12, calculating the clock offset of each AP according to the collected time stamp.

Step S13, establishing a clock offset model of each AP according to the clock offset of each AP

Assume that the clock offset model of the AP is , where is the initial value of the clock offset, and is the increasing slope of the clock offset. After estimating and by the least square method, the clock offset model of each AP can be obtained, as shown in Figure 2.

Step S14, judging whether an illegal AP is detected. If no illegal AP is detected, go back to step S13 and continue to build the clock offset model of each AP.

Step S15, if an illegal AP is detected, select several legal APs adjacent to the illegal AP, select at least 3 legal APs, for example, select at least 3 legal APs.

Step S16 , the selected legal AP collects a Received Signal Strength Indicator (RSSI) value relative to the illegal AP.

Step S17, locating illegal APs according to the collected RSSI values.

Step S18, judging whether the illegal AP has been removed. If the illegal AP has not been removed, go back to step S16, and let the selected legitimate AP collect the RSSI value relative to the illegal AP.

Step S19, if the illegal AP is removed, stop collecting RSSI values and locating the AP.

FIG. 3 is a flow chart of steps for locating an illegal AP according to an embodiment of the present invention, which is applied to a microcontroller of an electronic device. According to different requirements, the order of the steps in the flowchart can be changed, and some steps can be omitted.

Step S21, defining the virtual coordinates of legal APs in a network service area.

Plan the service area of the enterprise wireless network as a planar space with virtual coordinates, and configure virtual coordinates { X ₁ , X ₂ , X ₃ , …, X _n } for each legal AP to detect illegal APs by using legal APs The relative position and predicted coordinates of .

Step S22, defining at least one reference monitor point (Reference Monitor Point) in the network service area.

One or more observation points { P ₁ , P ₂ , P ₃ , ..., P _n } in the plane space of the aforementioned virtual coordinates are selected as reference points for measuring the RSSI value of each legitimate AP.

Step S23, measure and record the RSSI value of each legal AP, so as to obtain the RSSI vector value of the reference observation point relative to all legal APs.

When installing the wireless network, measure and record the signal strength of each legal AP through the terminal device on the observation point to establish the RSSI vector of the legal AP and each virtual coordinate. In addition, the signal strength of all legal APs is measured at each observation point to establish the RSSI correlation vector of each legal AP to all observation points (M1, M2), as shown in Figure 4. Table 1 records the RSSI correlation vectors of the observation points relative to all legal APs. Table 1 Legal AP of the observation point P ₁ ( a ₁ , b ₁ ) P ₂ ( a ₂ , b ₂ ) … P _n ( a _n , b _n ) AP ₁ ( x ₁ , y ₁ ) -35 -45 … -55 AP ₂ ( x ₂ , y ₂ ) -45 -55 … -35 . . . . . . . . . … . . . AP _m ( x _m , y _m ) -55 -45 … -65

Step S24, storing the measured RSSI vector value into a database.

In step S25, an RSSI correlation model (Correlation Model) of a legal AP related to the observation point is established according to the obtained RSSI vector value.

In step S26, an illegal AP is detected according to the established RSSI correlation model.

The wireless intrusion detection device continuously scans all wireless channels and collects Beacon packet information of APs. After the clock skew model of each AP is established, the growth slope 𝑏 ₁ of the clock skew of each AP is compared. If there is an unknown 𝑏 ₁ , it can be determined that the AP is an illegal AP, as shown in Figure 5.

When an illegal AP is detected, the wireless network controller will notify each legal AP to report the RSSI vector value of the detected illegal AP, so that the wireless network controller can locate the coordinates of the illegal AP ( P _r ( a _{n+ 1} , b _n+1 )), as shown in Table 2 and Figure 6. Table 2 Legal AP of the observation point P ₁ ( a ₁ , b ₁ ) P ₂ ( a ₂ , b ₂ ) … P _n ( a _n , b _n ) P _r ( a _n+1 , b _n+1 ) AP ₁ ( x ₁ , y ₁ ) -35 -45 … -55 -65 AP ₂ ( x ₂ , y ₂ ) -45 -55 … -35 -55 . . . . . . . . . … . . . . . . AP _m ( x _m , y _m ) -55 -45 … -65 -45

After receiving the RSSI vector value of the rogue AP detected by each legitimate AP, the wireless network controller will reconstruct the RSSI vector of the legitimate AP and send it to the clock offset model of the rogue AP to calculate the coordinates of the rogue AP.

The clock offset model of the illegal AP is to calculate the "cosine distance (Cosine Distance)" 'd' between the illegal AP and each observation point to obtain the observation point closest to the illegal AP and predict the coordinates of the illegal AP, such as Figure 7 shows.

Step S27, comparing the RSSI vector value of the illegal AP with the currently established RSSI correlation model.

Step S28, evaluating the position of the illegal AP according to the comparison result.

FIG. 8 is a schematic diagram of an operating state machine of a legal AP according to an embodiment of the present invention.

When the legal AP does not receive the event notification from the illegal AP, it is in the normal state of serving the wireless client (SERVING). If it receives an event notification that an illegal AP exists in the company's wireless network environment, it will enter the state of scanning for illegal APs (SCANNING). If it receives an event notification that a legitimate client connects to an illegal AP, it will enter the De-auth state (De-auth), and use the method of sending De-auth packets to interrupt the connection between the legitimate wireless client and the illegal AP.

When the legitimate AP receives the event notification from the illegal AP, it enters the scanning state (SCANNING) from the idle state (IDLE), indicating that it wants to detect illegal APs, then obtains the RSSI value of the neighboring APs, and detects whether there are illegal APs.

When the legitimate AP receives an event notification that a legitimate client connects to an illegal AP, it will enter the illegal connection state (De-auth) from the idle state (IDLE), and use the method of sending De-auth packets to interrupt the legal wireless network. The connection between the client and the rogue AP.

When the legal AP intends to enter the idle state (IDLE) from the scanning state (SCANNING), it means that the operation of detecting illegal APs will be completed, and then stop scanning the RSSI values of neighboring APs, and send a report to the wireless network management system (Wireless Network Management System, WNMS).

When the legal AP intends to enter the illegal connection state (De-auth) from the scanning state (SCANNING), it means that it receives an event notification that a legitimate client is connected to the illegal AP, and then enters the illegal connection state (IDLE) from the idle state (IDLE) De-auth), use the method of sending De-auth packets to interrupt the connection between the legitimate wireless client and the illegal AP.

When the legal AP has interrupted the connection between the legal wireless client and the illegal AP, it will switch to the normal operation state when it enters the service state (SERVING) from the illegal connection state (De-auth).

When the legal AP intends to enter the idle state (IDLE) from the service state (SERVING), no operation is performed.

When the legal AP intends to enter the scanning state (SCANNING) from the service state (SERVING), it means to detect illegal APs, then obtain the RSSI value of the neighboring APs, and detect whether there are illegal APs.

The detection method of the illegal base station implemented by the invention can detect whether there is an illegal AP in the wireless network of the enterprise in real time. In addition, the clock offset detection method implemented in the present invention can prevent illegal APs from pretending to be the MAC of legal APs in the enterprise wireless network. In addition, the detection method of illegal base stations in the embodiment of the present invention can not only improve the accuracy of the positioning model through self-learning of observation point data, but also quickly locate the location of illegal APs, greatly improving the security of enterprise wireless networks .

FIG. 9 is a schematic diagram showing the hardware architecture of the mobile electronic device according to the embodiment of the present invention. The electronic device 200 is, but not limited to, the processor 210, the memory 220, and the detection system 230 of an illegal base station that can communicate with each other through the system bus. FIG. 9 only shows the electronic device 200 with components 210-230, but It should be understood that implementation of all illustrated elements is not required and that more or fewer elements may instead be implemented.

The memory 220 includes at least one type of readable storage medium, which includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), Static Random Access Memory (SRAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), Programmable Read Only Memory (PROM), Magnetic Memory , Diskettes, CDs, etc. In some embodiments, the memory 220 may be an internal storage unit of the electronic device 10 , such as a hard disk or a memory of the electronic device 200 . In some other embodiments, the memory can also be an external storage device of the electronic device 200, such as a plug-in hard disk equipped on the electronic device 200, a smart memory card (Smart Media Card, SMC), a secure digital ( Secure Digital, SD) card, flash memory card (Flash Card), etc. Of course, the memory 220 may also include both the internal storage unit of the electronic device 200 and its external storage device. In this embodiment, the memory 220 is usually used to store the operating system and various application software installed in the electronic device 200 , such as the program code of the illegal base station detection system 230 . In addition, the memory 220 can also be used to temporarily store various types of data that have been output or will be output.

The processor 210 may be a central processing unit (Central Processing Unit, CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 210 is generally used to control the overall operation of the electronic device 200 . In this embodiment, the processor 210 is used to run the program codes stored in the memory 220 or process data, for example, to run the detection system 230 of the illegal base station.

It should be noted that FIG. 9 only illustrates the electronic device 200 as an example. In other embodiments, the electronic device 200 may also include more or less elements, or have different element configurations.

FIG. 10 is a functional block diagram of an electronic device according to an embodiment of the present invention, which is used to implement a method for detecting illegal base stations. The method for detecting an illegal base station in the embodiment of the present invention can be implemented by a computer program in a storage medium, for example, the memory 220 in the electronic device 200 . When the computer program implementing the method of the present invention is loaded into the memory 220 by the processor 210, the processor 210 driving the row device 200 executes the detection method of an illegal base station according to the embodiment of the present invention.

The electronic device 200 of the embodiment of the present invention includes a processing module 310 , a detection module 320 and a positioning module 330 .

The processing module 310 collects the time stamp of each AP's Beacon packet.

The wireless intrusion detection device (Wireless Intrusion Detector) scans each wireless transmission channel, and records the time stamp of the Beacon packet of each AP detected, for example, T ₀ , T ₁ , T ₂ ..., and calculates the time stamp of each Beacon packet The time difference value, for example, _Xi = T _i - T ₀ , is used as a database for building the clock offset model of each AP.

The processing module 310 calculates the clock offset of each AP according to the collected time stamp, and establishes a clock offset model of each AP according to the clock offset of each AP.

Assume that the clock offset model of the AP is , where is the initial value of the clock offset, and is the increasing slope of the clock offset. After estimating and by the least square method, the clock offset model of each AP can be obtained, as shown in Figure 2.

The detection module 320 determines whether an illegal AP is detected. If no illegal AP is detected, the processing module 310 continues to build a clock skew model of each AP.

If a rogue AP is detected, the detection module 320 selects several legitimate APs adjacent to the rogue AP, for example, selects at least 3 legitimate APs, and collects RSSI values relative to the rogue AP through the selected legitimate APs.

The location module 330 locates the illegal AP according to the collected RSSI value, and judges whether the illegal AP is removed. If the rogue AP has not been removed, the detection module 320 continues to allow the selected legitimate AP to collect RSSI values relative to the rogue AP. If the illegal AP is removed, the detection module 320 and the positioning module 330 stop collecting RSSI values and locating the AP.

FIG. 11 is a functional block diagram of a positioning module according to an embodiment of the present invention, which is used to locate illegal APs. The positioning module 330 of the embodiment of the present invention includes a definition unit 3310 , a measurement unit 3320 and a detection and positioning unit 3330 .

The defining unit 3310 defines the virtual coordinates of legal APs in a network service area.

Plan the service area of the enterprise wireless network as a planar space with virtual coordinates, and configure virtual coordinates { X ₁ , X ₂ , X ₃ , …, X _n } for each legal AP to detect illegal APs by using legal APs The relative position and predicted coordinates of .

The defining unit 3310 defines at least one reference monitor point (Reference Monitor Point) in the network service area.

One or more observation points { P ₁ , P ₂ , P ₃ , ..., P _n } in the plane space of the aforementioned virtual coordinates are selected as the reference point for measuring the RSSI value of each legitimate AP.

The measurement unit 3320 measures and records the RSSI value of each legal AP, so as to obtain the RSSI vector value of the observation point relative to all legal APs.

When installing the wireless network, measure and record the signal strength of each legal AP through the terminal device on the observation point to establish the RSSI vector of the legal AP and each virtual coordinate. In addition, the signal strength of all legal APs is measured at each observation point to establish the RSSI correlation vector of each legal AP to all observation points (M1, M2), as shown in Figure 4. Table 1 records the RSSI correlation vectors of the observation points relative to all legal APs. Table 1 Legal AP of the observation point P ₁ ( a ₁ , b ₁ ) P ₂ ( a ₂ , b ₂ ) … P _n ( a _n , b _n ) AP ₁ ( x ₁ , y ₁ ) -35 -45 … -55 AP ₂ ( x ₂ , y ₂ ) -45 -55 … -35 . . . . . . . . . … . . . AP _m ( x _m , y _m ) -55 -45 … -65

The measurement unit 3320 stores the measured RSSI vector value into a database.

The measurement unit 3320 establishes an RSSI correlation model (Correlation Model) of a valid AP related to the observation point according to the obtained RSSI vector value.

The detecting and locating unit 3330 detects illegal APs according to the established RSSI correlation model.

The wireless intrusion detection device continuously scans all wireless channels and collects Beacon packet information of APs. After the clock skew model of each AP is established, the growth slope 𝑏 ₁ of the clock skew of each AP is compared. If there is an unknown 𝑏 ₁ , it can be determined that the AP is an illegal AP, as shown in Figure 5.

When an illegal AP is detected, the wireless network controller will notify each legal AP to report the RSSI vector value of the detected illegal AP, so that the wireless network controller can locate the coordinates of the illegal AP ( P _r ( a _{n+ 1} , b _n+1 )), as shown in Table 2 and Figure 6. Table 2 Legal AP of the observation point P ₁ ( a ₁ , b ₁ ) P ₂ ( a ₂ , b ₂ ) … P _n ( a _n , b _n ) P _r ( a _n+1 , b _n+1 ) AP ₁ ( x ₁ , y ₁ ) -35 -45 … -55 -65 AP ₂ ( x ₂ , y ₂ ) -45 -55 … -35 -55 . . . . . . . . . … . . . . . . AP _m ( x _m , y _m ) -55 -45 … -65 -45

After receiving the RSSI vector value of the rogue AP detected by each legitimate AP, the wireless network controller will reconstruct the RSSI vector of the legitimate AP and send it to the clock offset model of the rogue AP to calculate the coordinates of the rogue AP.

The clock offset model of the illegal AP is to calculate the "cosine distance (Cosine Distance)" 'd' between the illegal AP and each observation point to obtain the observation point closest to the illegal AP and predict the coordinates of the illegal AP, such as Figure 7 shows.

The detecting and locating unit 3330 compares the RSSI vector value of the rogue AP with the currently established RSSI correlation model.

The detection and location unit 3330 evaluates the location of the illegal AP according to the comparison result.

If the integrated modules/units of the electronic device 200 are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the present invention realizes all or part of the processes in the methods of the above-mentioned embodiments, and it can also be completed by instructing related hardware through a computer program. The computer program can be stored in a computer-readable storage medium. The computer When the program is executed by the processor, the steps of the above-mentioned various method embodiments can be realized. Wherein, the computer program includes computer program code, and the computer program code may be in the form of original code, object code, executable file or some intermediate form. The computer readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, removable hard disk, magnetic disk, optical disk, computer memory, read-only memory, random access memory, Electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content contained in the computer readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. Including electrical carrier signals and telecommunication signals.

It can be understood that the module division described above is only a logical function division, and there may be another division method in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into the same processing unit, or each module may exist separately physically, or two or more modules may be integrated into the same unit. The above-mentioned integrated modules can be implemented in the form of hardware, or in the form of hardware plus software function modules.

The above embodiments are only used to illustrate the technical solutions of the present invention without limitation. Although the present invention has been described in detail with reference to the embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be modified or equivalently replaced, and Without departing from the spirit and scope of the technical solution of the present invention.

200: electronic device

210: Processor

220: memory

230: Detection system of illegal base stations

310: processing module

320: Detection Module

330: Positioning module

3310: define unit

3320: Measuring unit

3330: Detection and positioning unit

FIG. 1 is a flow chart of the steps of the method for detecting an illegal base station according to an embodiment of the present invention.

FIG. 2 is a schematic diagram of establishing a clock skew model according to an embodiment of the present invention.

Fig. 3 is a flow chart of steps for locating an illegal base station according to an embodiment of the present invention.

FIG. 4 is a schematic diagram of measuring RSSI vector values between an observation point and a legal AP according to an embodiment of the present invention.

FIG. 5 is a schematic diagram of detecting illegal base stations according to an embodiment of the present invention.

Fig. 6 is a schematic diagram of locating an illegal base station according to an embodiment of the present invention.

Fig. 7 is a schematic diagram of calculating the distance between an observation point and an illegal AP according to an embodiment of the present invention.

Fig. 8 is a schematic diagram of the operation state machine of the legal AP according to the embodiment of the present invention

FIG. 9 is a schematic diagram of a hardware architecture of an electronic device according to an embodiment of the present invention.

FIG. 10 is a functional block diagram of an electronic device according to an embodiment of the present invention.

FIG. 11 is a functional block diagram of a positioning module according to an embodiment of the present invention.

none

Claims (10)

A detection method for an illegal base station, applied to an electronic device, comprising the following steps: Collect time stamps of beacon (Beacon) packets of each of multiple wireless base stations (APs); Calculate the clock offset of each AP according to the collected timestamp; Establishing a clock offset model of each AP according to the clock offset of each AP; Judging whether an illegal AP is detected; If the illegal AP is detected, select a plurality of legal APs adjacent to the illegal AP; The selected legitimate APs collect received signal strength indicator (Received Signal Strength Indicator, RSSI) values relative to the rogue AP; and Locate the illegal AP according to the collected RSSI values. The method for detecting an illegal base station according to claim 1, wherein the step of locating the illegal AP according to the collected RSSI values further includes the following steps: Define the virtual coordinates of legal APs in a network service area; Define at least one Reference Monitor Point in the network service area; Measure and record the RSSI value of each legal AP to obtain the RSSI vector value of the reference observation point relative to all legal APs; storing the RSSI vector values into a database; Establish the complex RSSI correlation model (Correlation Model) of the legal APs related to the reference observation point according to the RSSI vector values; Detecting the illegal AP according to the RSSI correlation models; comparing one of the RSSI vector values of the rogue AP with the RSSI correlation models; and Estimate the location of the illegal AP based on the comparison result. The method for detecting illegal base stations as claimed in claim 2 further includes the following steps: The observation point in the plane space of the virtual coordinates is selected as a reference point for measuring the RSSI value of each legitimate AP. The method for detecting illegal base stations as claimed in item 1 further includes the following steps: determine whether the illegal AP is removed; and If the illegal AP is removed, stop the operation of collecting the RSSI value and locating the AP. The method for detecting illegal base stations as claimed in item 4 further includes the following steps: If the illegal AP has not been removed, continue to allow the selected legitimate APs to collect RSSI values relative to the illegal AP. The method for detecting illegal base stations as claimed in claim 1, wherein the time stamp of the Beacon packet of each AP in the collection further includes the following steps: Scan the wireless transmission channel of each AP through a wireless intrusion detection device (Wireless Intrusion Detector); record the time stamps of the Beacon packets that detect each of the APs; and The time difference value of each Beacon packet is calculated according to the time stamps as a database for establishing the clock offset models of each AP. An electronic device comprising: A processing module, used to collect the time stamp of the Beacon packet of each AP in the plurality of APs, calculate the clock offset of each AP according to the collected time stamp, and calculate the clock offset of each AP according to the clock offset of each AP Establish a clock offset model of each AP; A detection module, used to determine whether an illegal AP is detected, if the illegal AP is detected, select a plurality of legal APs adjacent to the illegal AP, and make these selected legal APs collect relative to the illegal AP the RSSI value of the AP; and A positioning module is used to locate the illegal AP according to the collected RSSI values. The electronic device according to claim 7, wherein the positioning module includes: A definition unit, used to define the virtual coordinates of a legal AP in a network service area, and define at least one reference observation point in the network service area; A measurement unit, used to measure and record the RSSI value of each legal AP, so as to obtain the RSSI vector value of the observation point relative to all legal APs, and store these RSSI vector values into a database; and A detecting and locating unit, used to establish complex RSSI association models of the legitimate APs related to the observation point according to the RSSI vector values, detect the illegal APs according to the RSSI association models, and place one of the illegal APs The RSSI vector value is compared with the RSSI correlation models, and the position of the illegal AP is estimated according to the comparison result. The electronic device according to claim 8, wherein the detecting and locating unit determines whether the illegal AP is removed, and if the illegal AP is removed, stops the operation of collecting RSSI values and locating the AP. A computer-readable storage medium, including a memory, a processor, and a computer program stored in the memory and operable on the processor, wherein, when the processor executes the computer program, the illegal base station of claims 1 to 6 is realized The steps of the detection method.

Images