WO2016045347A1

WO2016045347A1 - Malicious attack detection method, terminal, and computer storage medium

Info

Publication number: WO2016045347A1
Application number: PCT/CN2015/075973
Authority: WO
Inventors: 王彦东
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-09-25
Filing date: 2015-04-07
Publication date: 2016-03-31
Also published as: CN105516987A

Abstract

Disclosed in an embodiment of the present invention is a malicious attack detection method, the method comprising: upon receipt of a handshaking packet transmitted by a terminal in a wireless local area network (WLAN), authenticating the terminal; if the terminal authentication fails every time within a predetermined period, calculating the times of authentication failure within the predetermined period; and performing malicious attack detection on the terminal according to the times of authentication failure and a preset threshold for the times of authentication failure. Also disclosed in the embodiment of the present invention are a terminal and computer storage medium.

Description

Malicious attack detection method, terminal and computer storage medium

Technical field

The present invention relates to network detection technologies in wireless communication, and in particular, to a malicious attack detection method, a terminal, and a computer storage medium.

Background technique

Products with Wireless Fidelity (WiFi) certification comply with the IEEE 802.11b wireless network specification. IEEE 802.11b is the most widely used standard in wireless LAN (WLAN), with a band of 2.4 GHz. Globally, WLAN based WiFi technology has become more and more popular, and its coverage has become more and more extensive. WLAN has become a new way for more and more people, especially young people, to live online. More and more public places can use WLAN to quickly and easily surf, browse or download information online.

When an existing terminal accesses a WLAN network, if the terminal has a malicious attack behavior, the information security of the WLAN network may be threatened. For example, the terminal according to the information related to the WiFi hotspot, such as a vendor, a service set identifier (SSID, Service Set Identifier), The right mode, the medium access control (MAC) address, and the password shared by the netizen and the collected various WiFi passwords, use the corresponding dictionary resources to brute force to obtain the WiFi password multiple times in a period of time; or, the terminal according to the hotspot The interaction message with other terminals, for example, the handshake message, obtains the PMK, PTK or MIC check code, and then performs a dictionary attack according to the acquired PMK, PTK or MIC check code to obtain the WiFi password.

It can be seen that there is a need for a technical solution for detecting malicious attacks when accessing a WLAN.

Summary of the invention

The embodiments of the present invention are intended to provide a malicious attack detection method, a terminal, and a computer storage medium, which can detect malicious attacks, thereby preventing malicious attacks, thereby ensuring information security of the WLAN network.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

The embodiment of the invention provides a malicious attack detection method, and the method includes:

And receiving the handshake message sent by the terminal in the WLAN, and authenticating the terminal; if the terminal fails to perform the authentication in the preset time period, the number of authentication failures in the preset time period is counted;

And performing malicious attack detection on the terminal according to the number of authentication failures and a preset threshold of the number of authentication failures.

In another embodiment, the malicious attack detection on the terminal according to the number of the authentication failures and the preset number of authentication failures includes:

Comparing the number of authentication failures with a preset threshold of authentication failure times;

If the number of the authentication failures is less than the threshold of the number of authentication failures, the terminal is not detected as the terminal that performs the malicious attack, and the process is terminated.

And if the number of the authentication failures is greater than or equal to a preset threshold of the number of authentication failures, detecting that the terminal is a terminal that performs a malicious attack.

In another embodiment, the method further includes:

Pre-configure a blacklist of media access control MAC addresses of malicious attack terminals;

After the detection result of the malicious attack detection on the terminal is that the terminal is a terminal that performs a malicious attack, the method further includes:

Adding the MAC address of the terminal to the blacklist.

In another embodiment, the method further includes: controlling, by using a timer, a storage time of the MAC address of the terminal in the blacklist, when the timing of the timer expires, Deleting the MAC address of the terminal from the blacklist; or

The MAC address of the terminal is permanently added to the blacklist.

In another embodiment, after the receiving the handshake message sent by the terminal in the WLAN, the method further includes:

Obtaining a MAC address of the terminal in the handshake message;

Performing malicious attack detection on the terminal according to the obtained MAC address and the MAC address stored in the blacklist list;

And performing malicious attack detection on the terminal according to the obtained MAC address and the MAC address stored in the blacklist, including:

When the obtained MAC address is queried in the blacklist, the terminal is detected as a terminal that is maliciously attacked, and the process is terminated.

When the obtained MAC address is not found in the blacklist, the terminal is authenticated.

An embodiment of the present invention further provides a terminal, where the terminal includes: a statistics unit and a detecting unit;

The statistic unit is configured to perform the authentication on the terminal when receiving the handshake message sent by the terminal in the WLAN; if the terminal fails to perform the authentication in the preset time period, the preset time period is calculated. Number of failed authentications;

The detecting unit is configured to perform malicious attack detection on the terminal according to the number of authentication failures and a preset threshold of the number of authentication failures.

In another embodiment, the detecting unit is configured to compare the number of authentication failures with a preset number of authentication failure thresholds;

If the number of authentication failures is greater than or equal to a preset threshold of the number of authentication failures, the detection is performed. The terminal is a terminal that performs a malicious attack.

In another embodiment, the terminal further includes:

The setting unit is configured to pre-configure a blacklist of MAC addresses of malicious attack terminals;

The control unit is configured to add a MAC address of the terminal to the blacklist after the terminal detects that the terminal is a malicious attack.

In another embodiment, the control unit is further configured to control, by using a timer, a storage time of the MAC address of the terminal in the blacklist, when the timer expires, The MAC address of the terminal is deleted from the blacklist; or

The MAC address of the terminal is permanently added to the blacklist.

In another embodiment, the terminal further includes:

The pre-detection unit is configured to: after receiving the handshake message sent by the terminal in the WLAN, obtain the MAC address of the terminal in the handshake message; and according to the obtained MAC address and the MAC address stored in the blacklist list, Performing malicious attack detection on the terminal;

The embodiment of the invention further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the malicious attack detection method according to the embodiment of the invention.

The malicious attack detection method, the terminal, and the computer storage medium provided by the embodiment of the present invention perform authentication on the terminal when receiving the handshake message sent by the terminal in the WLAN; if the terminal is in the preset time period If the authentication fails, the number of authentication failures in the preset time period is counted. According to the number of authentication failures and the preset number of authentication failures, the terminal is Conduct malicious attack detection. As such, the embodiment of the present invention can detect malicious attacks, thereby preventing malicious attacks when detecting malicious attacks, thereby ensuring information security of the WLAN network.

DRAWINGS

1 is a schematic flowchart of implementing a malicious attack detection method according to an embodiment of the present invention;

FIG. 2 is a schematic structural diagram of a terminal of an embodiment of the present invention.

detailed description

In the embodiment of the present invention, when receiving the handshake message sent by the terminal in the WLAN, the terminal is authenticated; if the terminal fails to perform authentication every time in the preset time period, the preset time is counted. The number of authentication failures in the segment; performing malicious attack detection on the terminal according to the number of authentication failures and the preset number of authentication failure thresholds.

Here, the terminal having the WiFi function needs to perform the malicious attack detection first, and the terminal having the WiFi function may be the software module running under the operating system of the terminal that initiates the authentication, that is, the internal module of the terminal that initiates the authentication, which may also be called The malicious attack detection module detects malicious attacks on the terminal by the malicious attack detection module.

The method and apparatus of the present invention are further described below in conjunction with the drawings and specific embodiments.

The embodiment of the present invention provides a malicious attack detection method. FIG. 1 is a schematic flowchart of a malicious attack detection method according to an embodiment of the present invention; as shown in FIG. 1 , the method includes:

Step S100: When receiving the handshake message sent by the terminal in the WLAN, the terminal is authenticated; if the terminal fails to authenticate each time within the preset time period, the authentication failure in the preset time period is counted. frequency.

Here, the preset time period may be set based on a total time consumption of the WiFi client accessing the authentication in a normal situation, and the preset time period may be set as a sum of N total time consumptions, where N is a positive integer. , In this way, the preset time period may include N authentication processes; the higher the value set by N, the higher the security, but the overall access time is affected; the lower the value set by N, the normal user may be identified as A malicious user; the preset time period is not specifically limited in the embodiment of the present invention.

The malicious attack detection method in this embodiment may be applied to a wireless access node (AP), and the wireless AP may be a node device capable of implementing wireless network access of a wireless local area network, such as a wireless switch or a wireless router, or A terminal device with a wireless hotspot function, such as a smart phone or a tablet computer.

Here, the specific implementation process of the terminal accessing the WLAN network includes:

The terminal starts its own WiFi connection function, and the WiFi connection function can automatically search for the hotspot within the set range; the terminal sends a handshake message to the wireless AP, triggers the authentication process, and when receiving the handshake message sent by the terminal, starts to The terminal performs authentication; if the terminal fails to authenticate each time in the preset time period, the number of authentication failures in the preset time period is counted; if the terminal authentication succeeds in the preset time period, Enter the AP to start data service.

Step S101: Perform malicious attack detection on the terminal according to the number of authentication failures and a preset threshold number of authentication failures.

Here, the dictionary password of the malicious attack is mainly detected. Therefore, the threshold of the number of authentication failures needs to be set according to the frequency of the dictionary password transmission. The dictionary password includes a password that is habitually set by the user, and is mainly used to cooperate with the password deciphering software to improve the success rate of the password deciphering and shorten the deciphering time.

Specifically, the malicious attack detection on the terminal according to the number of the authentication failures and the preset number of authentication failures includes:

Here, if the terminal is not detected as a terminal for malicious attack, the terminal may be prompted to send a handshake message again, trigger the authentication process, and then return to step S100.

As an implementation manner, the method further includes: pre-configuring a blacklist list of the MAC address of the malicious attack terminal, and performing a malicious attack detection on the terminal in step S101, where the terminal is a terminal that performs a malicious attack. Thereafter, the method further includes:

Step S102: Add the MAC address of the terminal to the blacklist. Further, the timer of the terminal is used to control the storage time of the MAC address of the terminal in the blacklist, and if the timer expires, the MAC address of the terminal is from the blacklist. Delete; or,

The MAC address of the terminal is permanently added to the blacklist.

In an embodiment, in step S100, after receiving the handshake message sent by the terminal in the WLAN, acquiring the MAC address of the terminal in the handshake message; according to the obtained MAC address and the black The MAC address stored in the list is used to perform malicious attack detection on the terminal.

Specifically, the malicious attack detection on the terminal according to the obtained MAC address and the MAC address stored in the blacklist, including:

Here, if the MAC address of the obtained terminal is queried in the blacklist, the terminal is detected as a malicious attacking terminal, and the AP does not process any of the terminals sent by the terminal within the set time of the timer. The message; or, the AP permanently does not process any message sent by the terminal to prevent malicious attacks.

In the embodiment of the present invention, when receiving the handshake message sent by the terminal in the WLAN, the terminal is authenticated; if the terminal fails to perform authentication every time within the preset time period, the preset time period is counted. The number of authentication failures; the malicious attack detection is performed on the terminal according to the number of authentication failures and the preset number of authentication failure thresholds, so that malicious attacks can be detected, thereby performing malicious attacks when detecting malicious attacks. Blocking, thus ensuring the information security of the WLAN network.

In order to explain the embodiment of the present invention more clearly, the malicious detection process in the embodiment of the present invention is described in detail below by using specific embodiments:

Embodiment 1

Step 11: Pre-configure a blacklist of MAC addresses of malicious attack terminals;

Step 12: Acquire the MAC address of the terminal in the handshake message when receiving the handshake message sent by the terminal in the WLAN; and according to the obtained MAC address and the MAC address stored in the blacklist, The terminal performs a malicious attack detection to obtain a detection result;

Step 13: When the detection result is that the obtained MAC address is in the blacklist, the terminal is detected as a malicious attack terminal, and the current processing flow is ended;

Step 14: When the detection result is that the obtained MAC address is not in the blacklist, the terminal is authenticated; if the terminal fails in each authentication within a preset time period, the pre-count is calculated. Set the number of authentication failures in the time period;

Step 15: Compare the number of authentication failures with a preset threshold of authentication failure times to obtain a comparison result;

Step 16: When the comparison result is that the number of authentication failures is less than a preset threshold of the number of authentication failures, the terminal is not detected as a terminal for performing a malicious attack, and the process is terminated.

Step 17: When the comparison result is that the number of authentication failures is greater than or equal to a preset threshold of the number of authentication failures, detecting that the terminal is a terminal that performs a malicious attack, adding the MAC address of the terminal to the blacklist. In the list, and control the MAC of the terminal through a timer The storage time of the address in the blacklist list; when the timer expires, the MAC address of the terminal is deleted from the blacklist; or the MAC address of the terminal is permanent Sexually added to the blacklist.

In order to implement the foregoing method, the embodiment of the present invention further provides a terminal. The principle and method for solving the problem are similar. Therefore, the implementation process and implementation principles of the terminal can be described in the implementation process and the implementation principle of the foregoing method. It will not be repeated here.

2 is a schematic structural diagram of a terminal according to an embodiment of the present invention; as shown in FIG. 2, the terminal provided by the embodiment of the present invention includes: a statistics unit 200 and a detecting unit 201;

The statistic unit 200 is configured to perform authentication on the terminal when receiving the handshake message sent by the terminal in the WLAN; if the terminal fails to perform authentication every time in the preset time period, the preset time is counted. The number of authentication failures in the segment;

The detecting unit 201 is configured to perform malicious attack detection on the terminal according to the number of authentication failures and a preset threshold number of authentication failures.

The manner of dividing the above functional units or modules is only a preferred implementation manner of the embodiments of the present invention. The manner in which the functional units or modules are divided does not constitute a limitation on the embodiments of the present invention.

As an implementation manner, the detecting unit 201 is configured to compare the number of authentication failures with a preset number of authentication failure thresholds; if the number of authentication failures is less than a preset threshold of authentication failures, wait for the terminal The authentication process is triggered again. If the number of authentication failures is greater than or equal to the preset number of authentication failure thresholds, the terminal is detected as a terminal for malicious attack.

As an implementation manner, the terminal further includes:

The setting unit 202 is configured to pre-configure a blacklist of MAC addresses of malicious attack terminals;

The control unit 203 is configured to: after the detection result of the malicious attack detection on the terminal is that the terminal is a terminal that performs a malicious attack, add the MAC address of the terminal to the black name. Single list.

Specifically, the control unit 203 is further configured to control, by using a timer, a storage time of the MAC address of the terminal in the blacklist, and when the timing of the timer expires, the terminal is The MAC address is deleted from the blacklist; or,

The MAC address of the terminal is permanently added to the blacklist.

As an implementation manner, the terminal further includes:

The pre-detection unit 204 is configured to: after receiving the handshake message sent by the terminal in the WLAN, obtain the MAC address of the terminal in the handshake message; and obtain the MAC address stored in the blacklist according to the obtained MAC address. Performing malicious attack detection on the terminal;

When it is found that the obtained MAC address is in the blacklist, the terminal that detects the terminal as a malicious attack is detected;

In practical applications, the statistical unit 200, the detecting unit 201, the setting unit 202, the control unit 203, and the pre-detecting unit 204 may be processed by a central processing unit (CPU) located in the terminal. (MPU), digital signal processor (DSP), or field programmable gate array (FPGA) implementation.

In the embodiment of the present invention, the terminal may be a wireless AP, and the wireless AP may be a node device capable of implementing wireless network access of a wireless local area network, such as a wireless switch or a wireless router, or a terminal device having a wireless hotspot function. Such as smart phones, tablets and other equipment.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Industrial applicability

In the embodiment of the present invention, when the handshake message sent by the terminal in the WLAN is received, the terminal is authenticated; if the terminal fails to perform authentication every time in the preset time period, the preset time period is counted. The number of authentication failures; performing malicious attack detection on the terminal according to the number of authentication failures and the preset number of authentication failure thresholds. As such, the embodiment of the present invention can detect malicious attacks, thereby preventing malicious attacks when detecting malicious attacks. It ensures the information security of the WLAN network.

Claims

A malicious attack detection method, the method comprising:

And receiving the handshake message sent by the terminal in the WLAN, and authenticating the terminal; if the terminal fails to perform the authentication in the preset time period, the number of authentication failures in the preset time period is counted;

And performing malicious attack detection on the terminal according to the number of authentication failures and a preset threshold of the number of authentication failures.
The method according to claim 1, wherein the malicious attack detection on the terminal according to the number of the authentication failures and the preset number of authentication failures includes:

Comparing the number of authentication failures with a preset threshold of authentication failure times;

If the number of the authentication failures is less than the threshold of the number of authentication failures, the terminal is not detected as the terminal that performs the malicious attack, and the process is terminated.

And if the number of the authentication failures is greater than or equal to a preset threshold of the number of authentication failures, detecting that the terminal is a terminal that performs a malicious attack.
The method of claim 1 wherein the method further comprises:

Pre-configure a blacklist of media access control MAC addresses of malicious attack terminals;

After the detection result of the malicious attack detection on the terminal is that the terminal is a terminal that performs a malicious attack, the method further includes:

Adding the MAC address of the terminal to the blacklist.
The method according to claim 3, wherein the method further comprises: controlling, by a timer, a storage time of the MAC address of the terminal in the blacklist; when the timing of the timer expires, Deleting the MAC address of the terminal from the blacklist; or

The MAC address of the terminal is permanently stored in the blacklist.
The method of claim 3 wherein said receiving a terminal in a wireless local area network After the handshake message is sent, the method further includes:

Obtaining a MAC address of the terminal in the handshake message;

Performing malicious attack detection on the terminal according to the obtained MAC address and the MAC address stored in the blacklist list;

And performing malicious attack detection on the terminal according to the obtained MAC address and the MAC address stored in the blacklist, including:

When the obtained MAC address is queried in the blacklist, the terminal is detected as a terminal that is maliciously attacked, and the process is terminated.

When the obtained MAC address is not found in the blacklist, the terminal is authenticated.
A terminal, the terminal comprising: a statistical unit and a detecting unit; wherein

The statistic unit is configured to perform the authentication on the terminal when receiving the handshake message sent by the terminal in the WLAN; if the terminal fails to perform the authentication in the preset time period, the preset time period is calculated. Number of failed authentications;

The detecting unit is configured to perform malicious attack detection on the terminal according to the number of authentication failures and a preset threshold of the number of authentication failures.
The terminal according to claim 6, wherein the detecting unit is configured to compare the number of authentication failures with a preset number of authentication failure thresholds;

If the number of the authentication failures is less than the threshold of the number of authentication failures, the terminal is not detected as the terminal that performs the malicious attack, and the process is terminated.

And if the number of the authentication failures is greater than or equal to a preset threshold of the number of authentication failures, detecting that the terminal is a terminal that performs a malicious attack.
The terminal of claim 6, wherein the terminal further comprises:

The setting unit is configured to pre-configure a blacklist of MAC addresses of malicious attack terminals;

a control unit configured to perform a malicious attack detection on the terminal as the end result After the terminal is a terminal that performs a malicious attack, the MAC address of the terminal is added to the blacklist.
The terminal according to claim 8, wherein the control unit is further configured to control, by using a timer, a storage time of a MAC address of the terminal in the blacklist, when a timer time of the timer expires , deleting the MAC address of the terminal from the blacklist; or

The MAC address of the terminal is permanently added to the blacklist.
The terminal of claim 8, wherein the terminal further comprises:

The pre-detection unit is configured to: after receiving the handshake message sent by the terminal in the WLAN, obtain the MAC address of the terminal in the handshake message; and according to the obtained MAC address and the MAC address stored in the blacklist list, Performing malicious attack detection on the terminal;

When the obtained MAC address is queried in the blacklist, the terminal is detected as a terminal that is maliciously attacked, and the process is terminated.

When the obtained MAC address is not found in the blacklist, the terminal is authenticated.
A computer storage medium storing computer executable instructions for performing the malicious attack detection method according to any one of claims 1 to 5.