WO2018113726A1

WO2018113726A1 - Ap risk detection method and apparatus

Info

Publication number: WO2018113726A1
Application number: PCT/CN2017/117688
Authority: WO
Inventors: 刘天; 张建新; 高永岗
Original assignee: 北京奇虎科技有限公司
Priority date: 2016-12-21
Filing date: 2017-12-21
Publication date: 2018-06-28
Also published as: CN106506546B; CN106506546A

Abstract

Provided is an AP risk detection method and apparatus. The method comprises: determining, according to the type of a wireless access point (AP) to be detected, the type of target parameters and a security test scheme of the AP to be detected which are required to be obtained, wherein the security test scheme comprises a computing scheme representative of computing a security score of the AP to be detected based on a parameter of type of the target parameters and a pre-set score representative of the security of the AP to be detected, wherein the type of parameters and the security test scheme corresponding to different types of the AP are not identical; detecting the AP to be detected according to the type of the target parameters, and obtaining a first parameter of the type of the target parameters; computing the security score of the AP to be detected based on the first parameter and the computing scheme; determining whether the security score of the AP to be detected reaches the pre-set score; and determining that a risk exists in the AP to be detected when the security score of the AP to be detected does not reach the pre-set score.

Description

Method and device for detecting AP risk

Cross-reference to related applications

The present application claims priority to Chinese Patent Application No. 201611193270.4, entitled "A Method and Apparatus for Detecting AP Risks", filed on December 21, 2016, the entire contents of which is incorporated herein by reference. in.

Technical field

The present disclosure relates to the field of electronic technologies, and in particular, to a method and an apparatus for detecting an AP risk.

Background technique

With the application of the breadth and depth of the network, the integration of daily life and work and the network is getting closer and closer, and users can use the network to work, shop, transfer, and even control the home. However, while we operate on the Internet through various things, insecure APs (Access Points) put our property and privacy at risk.

At present, most related technologies detect AP risk by judging the AP's SSID (Service Set Identifier), BSSID (Basic Service Set Identifier), and IP (Network Protocol, Internet Protocol). Whether to detect in the blacklist library. Therefore, there is a technical problem that the detection accuracy is not high.

Summary of the invention

The embodiments of the present disclosure provide a method and a device for detecting an AP risk, which are used to improve the detection accuracy of an AP risk.

In a first aspect, the present disclosure provides a method for AP risk detection, including:

Determining, according to the type of the AP to be detected, the target parameter type of the AP to be detected and the security test plan, the security test plan includes a calculation scheme for calculating the security score of the AP to be detected based on the parameter of the target parameter type and A preset score indicating the security of the AP to be detected; wherein the parameter type and the security test scheme corresponding to the types of different APs are not completely the same;

The AP to be detected is detected according to the target parameter type, and the first parameter of the target parameter type is obtained;

Calculating a security score of the AP to be detected based on the first parameter and the calculation scheme;

Determining whether the security score of the AP to be detected reaches a preset score;

When the security score of the AP to be detected does not reach the preset score, it is determined that the AP to be detected has a risk.

In a second aspect, the present disclosure provides an apparatus for AP risk detection, including:

a first determining module, configured to determine, according to a type of the wireless access point AP to be detected, a target parameter type of the AP to be detected and a security test plan, where the security test solution includes calculating a parameter to be detected based on the parameter of the target parameter type The calculation scheme of the security score and the preset score indicating the security of the AP to be detected; wherein the parameter types and security test schemes corresponding to the types of different APs are not completely the same;

a first obtaining module, configured to detect the AP to be detected according to the target parameter type, and obtain a first parameter of the target parameter type;

a calculation module, configured to calculate a safety score of the AP to be detected based on the first parameter and the calculation scheme;

a determining module, configured to determine whether a security score of the AP to be detected reaches a preset score;

The second determining module is configured to determine that the AP to be detected is at risk when the security score of the AP to be detected does not reach the preset score.

In a third aspect, the present disclosure provides a computer program comprising:

Computer readable code, when the computer readable code is run on a computing device, causes the computing device to perform the method of AP risk detection described above.

In a fourth aspect, the present disclosure provides a computer readable medium, comprising:

A computer program for performing the above-described method of AP risk detection is stored.

The above one or more technical solutions in the embodiments of the present disclosure have at least one or more of the following technical effects:

In the technical solutions of the embodiments of the present disclosure, different types of APs correspond to different target type parameters and security test schemes. Therefore, firstly, according to the type of the AP to be detected, the target parameter types and security of the AP to be detected need to be obtained. The test solution includes a calculation scheme for calculating a security score of the AP to be detected based on the parameter of the target parameter type, and a preset score indicating the security of the AP to be detected, and then detecting the AP to be detected according to the target parameter type, and obtaining the target parameter. And determining, according to the first parameter and the calculation scheme, the security score of the AP to be detected, and determining whether the security score of the AP to be detected reaches a preset score, when the security score of the AP to be detected does not reach the preset score. Determine the risk of the AP to be detected. It can be seen that, in the embodiment of the present disclosure, the first parameter of the target parameter type corresponding to the AP type to be detected is performed, and the calculation scheme corresponding to the type of the AP to be detected is performed on the first parameter, and finally according to the type of the AP to be detected. A corresponding preset score is used to determine whether the AP is at risk. Since different types of AP security standards are different, different types of APs are detected for different parameters and different calculation schemes are performed for detection, so that the final detection result is more targeted and more accurate.

BRIEF abstract

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

1 is a flowchart of a method for AP risk detection in an embodiment of the present disclosure;

2 is a schematic structural diagram of an apparatus for detecting AP risk in an embodiment of the present disclosure;

FIG. 3 schematically illustrates a block diagram of a computing device for performing a method of AP risk detection in accordance with an embodiment of the present disclosure;

FIG. 4 schematically illustrates a storage unit for maintaining or carrying program code that implements a method of AP risk detection in accordance with an embodiment of the present disclosure.

Preferred embodiment of the invention

Embodiments of the present disclosure provide a method and apparatus for AP risk detection, which are used to improve the accuracy of AP risk detection.

In order to solve the above technical problems, the technical solutions provided by the present disclosure are as follows:

The technical solutions of the present disclosure are described in detail below with reference to the accompanying drawings and specific embodiments. It is understood that the specific features of the embodiments and the embodiments of the present disclosure are the detailed description of the technical solutions of the present disclosure, and In the case of no conflict, the technical features of the embodiments of the present disclosure and the embodiments may be combined with each other.

The term "and/or" in this context is merely an association describing the associated object, indicating that there may be three relationships, for example, A and / or B, which may indicate that A exists separately, and both A and B exist, respectively. B these three situations. In addition, the character "/" in this article generally indicates that the contextual object is an "or" relationship.

A first aspect of the present disclosure provides a method for AP risk detection. Referring to FIG. 1, a flowchart of a method for AP risk detection in an embodiment of the present disclosure is provided. The method includes:

S101: Determine, according to the type of the wireless access point AP to be detected, a target parameter type of the AP to be detected and a security test plan, where the security test solution includes calculating a security score of the AP to be detected based on the parameter of the target parameter type. The scheme and the preset score indicating the security of the AP to be detected; wherein the parameter type and the security test scheme corresponding to the types of different APs are not completely the same;

S102: Perform detection on the AP to be detected according to the target parameter type, and obtain a first parameter of the target parameter type;

S103: Calculate a security score of the AP to be detected based on the first parameter and the calculation scheme;

S104: Determine whether the security score of the AP to be detected reaches a preset score;

S105: When the security score of the AP to be detected does not reach the preset score, determine that the AP to be detected has a risk.

Specifically, in the embodiment of the present disclosure, the types of the AP include, but are not limited to, a public AP, a company AP, and a private AP. The public AP refers to an AP operated by a certain company, enterprise, or organization for accessing a large number of arbitrary UEs (User Equipment); the company AP refers to a company, enterprise, or organization operating for the An AP that is accessed by a UE of a user of a company, a company, or an organization; a private AP refers to an AP that is set by an individual and is only accessible by a few special UEs, such as a home user.

Since different types of APs have different usage scenarios and have different risks in the specific implementation process, in the embodiments of the present disclosure, different types of APs correspond to different parameter types and security testing schemes. The parameter type refers to the type of parameters that need to be acquired to detect whether an AP has a risk, such as SSID (Service Set Identifier), BSSID (Basic Service Set Identifier), AP open port. IP address of the AP operating system, its own carrier and/or manufacturer, location, network segment, DNS server, DNS (Domain Name System) server name, page content of the AP management page, and page of the AP login page. Content, etc. The security test solution includes a calculation plan and a preset score. The calculation plan indicates how to calculate a security score based on the specific parameter corresponding to the parameter type, and the security score represents the security level of the AP to be detected; the preset score indicates that the AP security of the type should be The score reached.

In a specific implementation process, for a different type of AP, a person of ordinary skill in the art may set a parameter type and a security test solution according to the characteristics of each type of AP, and the disclosure is not specifically limited. The following is an example of three types of APs: a public AP, a private AP, and a corporate AP. In the specific implementation process, the following examples are included.

Public AP:

In the specific implementation process, the criminals falsify the APs at risk by imitating the more obvious features of the AP such as SSID. However, for a secure AP, the invisible features of the AP's open port, DNS server name, assigned network segment, AP's operating system, and AP's login page are difficult to fully imitate. Also, for public APs, public APs are usually produced by several known manufacturers and are set up in public places by known operators, such as shopping malls, pedestrian streets, and plazas.

Therefore, in the embodiment of the present disclosure, the parameter types corresponding to the public AP may be specifically: the AP operating system, the AP open port, the location, the user access volume, the manufacturer, the DNS server name, the allocated network segment, the MAC address, and the AP management page. Page content and page content of the AP login page. The AP operating system is the operating system of the AP. The open port of the AP is the port open to the AP. The location is the location of the AP.

The calculation scheme of the public AP is specifically: 5 points for the AP operating system, 5 points for the AP open port, 2 points for the location, 2 points for the user access, 3 points for the manufacturer, and 1 point for the DNS server name. The network segment corresponds to 3 points, the MAC address corresponds to 3 points, the page content of the AP management page corresponds to 2 points, and the page content of the AP login page corresponds to 2 points; if the parameter type parameter does not satisfy the preset condition corresponding to the parameter type, then the public The score corresponding to the parameter type is subtracted from the AP's benchmark score. Wherein, since most public APs are not secure, the reference score of the public AP should be set lower, for example, 50 points in the embodiment of the present disclosure.

The default score for the public AP is 40 points.

Private AP:

For a private AP, since the private AP involves more user privacy and property information, the more the parameter types of the private AP are, the more comprehensive the private AP can be detected. Certainly, in the specific implementation process, those skilled in the art to which the present disclosure belongs may select according to actual conditions, and the disclosure does not specifically limit.

In the following, it is assumed that the parameter types of the private AP are specifically: the AP open port, the historical connection user, the AP operating system, the allocated network segment, the MAC address, the page content of the AP management page, and the page content of the AP login page. The historical connection user refers to the UE that has accessed the AP.

The calculation scheme of the AP is as follows: the AP open port corresponds to 20 points, the historical connection user corresponds to 10 points, the AP operating system corresponds to 20 points, the allocated network segment corresponds to 20 points, the MAC address corresponds to 10 points, and the AP management page page content. If the parameter of the parameter type does not satisfy the preset condition corresponding to the parameter type, the score corresponding to the parameter type is subtracted from the reference point of the private AP. The reference score of the private AP may be set higher because the private AP is less likely to send the phishing. In the embodiment of the present disclosure, for example, 100 points.

The default score for a private AP is 80 points.

Company AP:

Since a company AP is usually used by a UE of a user of a company, a company, or an organization, for example, a company employee or the like. In the specific implementation process, the users accessing the AP are generally concentrated in a period of time, for example, the working time period is 8:00 to 17:00.

Therefore, in the embodiment of the present disclosure, the parameter type corresponding to the company AP may be specifically: the AP operating system, the AP open port, the user access amount, the user online time, the allocated network segment, the MAC address, the page content of the AP management page, and the AP. The page content of the login page. The online time of the user is the user access time and the exit time of the access company AP.

The calculation scheme of the AP is as follows: the AP operating system corresponds to 20 points, the AP open port corresponds to 20 points, the user access amount corresponds to 10 points, the user online time corresponds to 20 points, the allocated network segment corresponds to 10 points, and the MAC address corresponds to 10 points. The page content of the AP management page corresponds to 10 points and the page content of the AP login page corresponds to 10 points. The reference score of the company AP in the embodiment of the present disclosure is, for example, 100 points, because the possibility that the company AP sends the phishing is low.

The AP's default score is 80 points.

Because the parameter types and the security test schemes of the different APs in the embodiment of the present disclosure are not completely the same, in S101, the target parameter type and security test of the AP to be detected are determined according to the type of the AP to be detected. Program.

Specifically, in order to determine the type of the AP to be detected, before S101, the method further includes:

Performing detection on the detecting AP to obtain a second parameter indicating the type of the AP to be detected;

Based on the second parameter, the type of the AP to be detected is determined.

Specifically, the second parameter is a parameter that can indicate the type of the AP, including but not limited to the security attribute of the AP, the amount of user access, the location, and the like. The detection of the AP is detected, and then the second parameter of the AP to be detected is obtained, and then the type of the AP to be detected is determined based on the second parameter.

Specifically, according to different second parameters, it is determined that the types of APs to be detected are different, and several of them will be described below. In the specific implementation process, including but not limited to the following ways.

The first type: determines whether the security attribute of the AP to be detected is OPEN. If the security attribute of the AP to be detected is OPEN, it is determined that the type of the AP to be detected is a public AP. If the security attribute of the AP to be detected is not OPEN, it is determined that the AP to be detected is a private AP or a company AP.

The second type: determining the user access amount of the AP to be detected is in the range of the public AP, the range of the company AP, or the range of the private AP. If the user access amount of the AP to be detected is in the range of the public AP, it is determined that the AP to be detected is a public AP; if the user access amount of the AP to be detected is in the range of the company AP, it is determined that the AP to be detected is a company AP; When the user access amount of the AP is detected in the range of the private AP, it is determined that the AP to be detected is a private AP.

In a specific implementation process, the range of the public AP may be set to be larger than the range of the company AP, and the range of the formula AP is larger than the range of the private AP. For example, the range of the public AP is greater than 500, the range of the company AP is greater than 30 and less than or equal to 500, and the range of the private AP is greater than or equal to 0 and less than or equal to 30.

The third type: determining whether the location of the AP to be detected is in a public area or a non-public area. If the location of the AP to be detected is in the public area, it is determined that the AP to be detected is a public AP or a company AP; if the location of the AP to be detected is in the non-public area, it is determined that the AP to be detected is a private AP. The public area is, for example, a shopping mall, an office building, a plaza, a pedestrian street, and the like. The non-public area is, for example, a residential area, a residential area, and the like. The person skilled in the art to which the present disclosure pertains may be physically set. The present disclosure is not specifically limited.

The fourth type: determining whether the proportion of the online time of the user to be detected in the working time reaches the first threshold. If the proportion of the user's online time in the working time reaches the first threshold, the AP to be detected is determined to be the company AP; if the proportion of the online time of the user to be detected in the working time does not reach the first threshold, then it is determined. The AP to be detected is a public AP or a private AP. The working time is, for example, 8:00 to 17:00, or 9:00 to 19:00, and the like, and the present disclosure is not specifically limited.

For example, assume that the working time is 8:00 to 17:00 and the first threshold is 75%. During the online time of all the users of the AP to be detected, 85% of the online time of the user is within the working time, and the first threshold is reached. Therefore, it is determined that the AP to be detected is a company AP. In the online time of all the users of the AP to be detected, 20% of the online time of the user is within the working time, and the first threshold is not reached. Therefore, it is determined that the AP to be detected is a public AP or a private AP.

The fifth type: combining the second type and the third type, determining whether the user access amount of the AP to be detected is in the range of the public AP, the range of the company AP or the range of the private AP, and whether the location of the AP to be detected is in the public area or Non-public area. If the user access amount of the AP to be detected is in the range of the public AP, and the location is in the public area, it is determined that the AP to be detected is a public AP; if the user access amount of the AP to be detected is in the range of the company AP, and the location is in the public In the location area, the AP to be detected is determined to be a corporate AP. If the user access volume of the AP to be detected is in the range of the private AP and the location is in the non-public area, the AP to be detected is determined to be a private AP.

The sixth type: in combination with the second type, the third type, and the fourth type, determines whether the user access amount of the AP to be detected is in the range of the public AP, the range of the company AP, or the range of the private AP, and whether the location of the AP to be detected is in the public. Whether the proportion of the online time of the user or the non-public area of the AP and the online time of the AP to be detected during the working time reaches the first threshold. If the user access amount of the AP to be detected is in the range of the public AP, and the location is in the public area, but the proportion of the online time of the user in the working time does not reach the first threshold, it is determined that the AP to be detected is a public AP; If the user access of the AP is in the range of the AP, the location is in the public area, and the proportion of the user's online time in the working time reaches the first threshold, the AP to be detected is determined to be the company AP; The amount is in the range of the private AP, and the location is in the non-public area. However, if the proportion of the online time of the user in the working time does not reach the first threshold, it is determined that the AP to be detected is a private AP.

In the specific implementation process, one of ordinary skill in the art to which the present disclosure belongs may select any one of the above six manners, or other manners, and the present disclosure is not specifically limited.

In addition, in the embodiment of the present disclosure, the execution body of S101 to S105 may be the UE itself, or may be a server connected to the UE. When the executor is the UE, the UE may download the parameter type and the security test plan corresponding to the type of the AP from the server, and then detect the second parameter of the AP to be detected, and determine the type of the AP to be detected based on the second parameter. After that, according to the parameter type and the security test plan obtained by the download, the target parameter type and the security test plan corresponding to the AP to be detected are determined. When the executor is the server, the server obtains the second parameter that the UE detects and reports the AP, and determines the type of the AP to be detected based on the second parameter reported by the UE, and determines the target parameter type and security test corresponding to the AP to be detected. The solution then delivers the target parameter type to the UE. In the specific implementation process, a person of ordinary skill in the art to which the present disclosure belongs may perform the subject according to the actual selection, and the disclosure is not specifically limited.

Further, regardless of whether the execution subject is a UE or a server, in S102, the UE further detects the AP to be detected based on the target parameter type, thereby obtaining the first parameter of the target parameter type. Specifically, the first parameter in the embodiment of the present disclosure is a specific parameter of the target parameter type. For example, if the target parameter type is specifically the AP operating system, the AP open port, and the user access amount, the UE detects the AP operating system, the AP open port, and the user access amount, and obtains the first parameter “**; 80, 50,04;3". Here, for convenience of description, the embodiment of the present disclosure denotes an operating system code by "**". Where ** is the parameter of the target parameter type AP operating system. 80, 50, and 04 are the parameters of the open port of the target parameter type. The operating ports of the AP device that are to be detected are 80 ports, 50 ports, and 04 ports. 3 is a parameter of the target parameter type, indicating that there are three users of the AP to be detected.

In the embodiment of the present disclosure, if the execution subject is the UE, the UE acquires the first parameter after detecting the first parameter. If the execution entity is a server, the server obtains the first parameter specifically for receiving the first parameter detected and reported by the UE.

Next, after the first parameter is obtained, S103 is performed, that is, the security score of the AP to be detected is calculated based on the first parameter and the calculation scheme. Then, in S104, it is determined whether the security score of the AP to be detected reaches a preset score, specifically whether the security score of the AP to be detected is greater than or equal to the preset score. If the security score of the AP to be detected reaches the preset score, it indicates that the risk of the AP to be detected is small and is a secure AP. Conversely, if the security score of the AP to be detected does not reach the preset score, it indicates that the to-be-detected is unsafe and there is a risk.

According to the solution in the foregoing embodiment, different APs are configured to detect different target parameter types, perform different calculation schemes, and set different preset scores. Therefore, it is implemented to detect risks according to different types of APs in different manners, so The accuracy of detecting risks for different types of APs.

The following describes how to calculate the security score of the AP to be detected.

In an optional embodiment, the AP to be detected is at least one of a public AP or a private AP. Further, the AP to be detected may also be a company AP.

Specifically, when the type of the AP to be detected is specifically a public AP, the target parameter type includes at least an AP operating system and an AP open port, and the first parameter is the first operating system and the first open port, and the S103 is specifically implemented by the following process. :

Determining whether the first operating system of the AP to be detected is a user terminal system;

When the first operating system of the AP to be detected is the user terminal system, the score corresponding to the AP operating system is subtracted from the public AP reference score;

Determining whether the user terminal port is included in the first open port of the AP to be detected;

When the first issuing port of the AP to be detected includes the user terminal port, the score corresponding to the AP open port is subtracted from the public AP reference score.

Specifically, the user terminal system in the embodiment of the present disclosure is a system used by the user terminal, such as a Linux system, a Windows system, a Mac system, and an Android system. The user terminal port is a gateway open port provided by the AP device for the user terminal, for example, port 21 and port 04 of the TP-LINK.

Generally, the AP is not a user terminal system but a system dedicated to the AP. Therefore, if the AP operating system of the AP to be detected is a user terminal system, the AP to be detected may be simulated by the user terminal. risk. In addition, the secure AP usually provides the user with an open port. For example, TP-LINK will provide 80 ports for router configuration and management, 67 ports and 68 ports for basic network configuration, and port 53 for DNS query service. A secure AP does not open a user terminal port. Therefore, if the AP to be detected is open to the user terminal port, it indicates that the AP to be detected and the security AP are abnormal, and there is a risk of phishing.

Therefore, when the AP to be detected is a public AP, it is required to determine whether the first operating system of the AP to be detected is a user terminal system. The first operating system is a specific operating system of the detected AP to be detected. The method for determining whether the first system is a user terminal system is to match the characteristics of the first system with the plurality of user terminal systems, and if the first system matches the features of one of the user terminal systems, determining that the first system is a user terminal system . If the first system does not match the features of all user terminal systems, it is determined that the first system is not the user terminal system. When the first operating system of the AP to be detected is the user terminal system, the score corresponding to the AP operating system is subtracted from the public AP reference score.

In addition, it is also required to determine whether the user terminal port is included in the first open port of the AP to be detected. The first open port is a port that is specifically opened for the AP to be detected. Assuming that the user terminal port is the 21 port and the 04 port, it is determined whether the 21 port and/or the 04 port are included in the first open port. When the first issuing port of the AP to be detected includes the user terminal port, the score corresponding to the AP open port is subtracted from the public AP reference score.

For example, if the first operating system is "**", the first open port is 80, 60, and 21, the public AP's reference is 50 points, and the AP operating system's score is 10 points. The AP open port corresponds to The score is 10 and the default score is 45. By matching, it is determined that the first operating system "**" is an Android system, which is a user terminal system, and 21 of the first open port is a user terminal port, so 20 points are subtracted from the benchmark score of 50 points, and finally the AP to be detected is obtained. The safety score is 30 points. Since the security score of the AP to be detected does not reach the preset score of 45 points, it is determined that the AP to be detected is at risk.

In addition, in the example above, when the AP to be detected is a public AP, the target parameter types are: AP operating system, AP open port, location, user access amount, manufacturer, DNS server name, allocated network segment, The MAC address, the page content of the AP management page, and the page content of the AP login page.

The first parameters are: ** (AP operating system); 80, 60 and 21 (AP open port); Wangfujing Pedestrian Street (location); 10 (user access); ABC (producer); DEF (DNS server name) ;11.0.0.0~11.0.0.100 (assigned network segment); 58:66:ba:6e:57:20 (MAC address).

The AP operating system corresponds to 5 points, the AP open port corresponds to 5 points, the location corresponds to 2 points, the user access amount corresponds to 2 points, the manufacturer corresponds to 3 points, the DNS server name corresponds to 1 point, the allocated network segment corresponds to 3 points, and the MAC address corresponds to 3 points, the page content of the AP management page corresponds to 2 points, and the page content of the AP login page corresponds to 2 points. The public AP's benchmark is divided into 50 points and the default score is 40 points.

By matching, it is determined that the first operating system "**" is an Android system and is a user terminal system, so 5 points are subtracted from the benchmark score of 50 points. 21 of the first open port is a user terminal port, so 5 points are subtracted from the benchmark score of 50 points. 21 of the first open port is a user terminal port, so 5 points are subtracted from the benchmark score of 50 points. Wangfujing Pedestrian Street belongs to the public area, so it is not necessary to subtract the score corresponding to the location. User traffic does not reach a range greater than 500, so 2 points are subtracted from the benchmark minutes. Producer ABC is not a known manufacturer of public APs, so 3 points are subtracted from the benchmark. The DNS server name DEF is inconsistent with all known secure DNS server names of the public AP, so 1 point is subtracted from the benchmark score. The allocated network segment has a small range and does not reach the number of 256 to 65534 subnets, so 3 points are subtracted from the reference score. The MAC address 58:66:ba:6e:57:20 is consistent with one of the known secure MAC addresses of the public AP, so there is no need to subtract the score corresponding to the MAC address. The page content of the AP management page and the page content of the AP login page are not described in detail here, and the page content of the AP management page and the page content of the AP login page and the page content of the preset secure AP management page are The content of the page of the secure AP login page is the same, so you do not need to subtract the page content of the AP management page and the score corresponding to the page content of the AP login page.

Therefore, the safety score = 50-5-5-5-2-3-1-3=26.

Since the security score does not reach the preset score of 40 points, it is determined that the AP to be detected is at risk.

In addition, when the type of the AP to be detected is specifically a private AP, the target parameter type includes at least an AP open port and a historical connection user, and the first parameter is the second port and the second user, and S103 is specifically implemented by the following process:

Determining whether a non-private AP attribute port is included in the second port of the AP to be detected;

When the second open port of the AP to be detected includes the non-private AP attribute port, the score corresponding to the AP open port is subtracted from the private AP reference point;

Determining whether the second user includes a user who does not have the right to connect to the AP to be detected;

When the second user of the AP to be detected includes a user who does not have the right to connect to the AP to be detected, the score corresponding to the historical connection user is subtracted from the private AP reference score.

Specifically, the non-private AP attribute port in the embodiment of the present disclosure is, for example, a port that is not normally opened by a routing device of a private AP, such as a port 21 or a 04 port.

The ports that are usually secure private APs include ports 80, 67, 68, and 53, and do not include non-private AP attribute ports. Therefore, if the AP to be detected opens a non-private AP attribute port, it indicates that the AP to be detected and the security AP are abnormal, and there is a risk of phishing. In addition, the private AP is generally only used by users who have the right to connect to the AP, such as family members, friends, etc. Therefore, if there is a user who does not have the connection right among the historical connection users, it means that the AP to be detected has been attacked by others. Therefore, when there is a user who does not have the connection right among the historical connection users, it indicates that the AP to be detected is at risk.

Therefore, when the AP to be detected is a private AP, it is required to determine whether the non-private AP attribute port is included in the second open port of the AP to be detected. The second open port is a port that is specifically opened for the AP to be detected. Assuming that the non-private AP attribute port is port 21 and port 04, it is determined whether the port 21 and/or port 04 are included in the second open port. When the non-private AP attribute port is included in the second issuing port of the AP to be detected, the score corresponding to the AP open port is subtracted from the public AP reference point.

In addition, it is also necessary to determine whether the second user includes a user who does not have the right to connect to the AP to be detected. Specifically, the security user list with the right to connect to the AP to be detected may be pre-stored, and then the historical connection user is determined to be in the security user list based on the security user list. If there is a historical connection user that is not in the security user list, it indicates that the second user includes a user who does not have the right to connect to the AP to be detected, so the score corresponding to the historical connection user is subtracted from the private AP reference score.

For example, suppose the second open port is 80, 60, and 21, the historical connection users are a, b, c, and d, the private AP's reference is divided into 100 points, and the AP open port corresponds to a score of 10, and the historical connection is The user's score is 20 points and the default score is 80 points. 21 of the second open port is a non-private attribute port, so 20 points are subtracted from the benchmark score of 100 points. The list of security users is a, b, c, and e. Therefore, the historical connection user d is not in the security user list, so 10 points are subtracted from the benchmark score of 100 points. Finally, the security score of the AP to be detected is 70 points. Since the security score of the AP to be detected does not reach the preset score of 80 points, it is determined that the AP to be detected is at risk.

In addition, in the example above, when the AP to be detected is a private AP, the target parameter types are: an AP open port, a historical connection user, an AP operating system, an allocated network segment, a MAC address, and an AP management page. Content and page content of the AP login page.

The first parameters are: 80, 60, and 21 (AP open ports); a, b, c, d (historical connection users); ** (AP operating system); 192.168.0.0-192.168.0.10 (assigned network segments) ;5c: ad:cf:46:b8:af (MAC address).

The AP open port corresponds to 20 points, the historical connection user corresponds to 10 points, the AP operating system corresponds to 20 points, the assigned network segment corresponds to 20 points, the MAC address corresponds to 10 points, and the page content of the AP management page corresponds to 10 points. The page of the AP login page The content corresponds to 10 points. The private AP's benchmark is divided into 100 points and the default score is 80 points.

By matching, it is determined that the first operating system "**" is an Android system, which is a user terminal system, so 20 points are subtracted from the benchmark score of 100 points. 21 of the first open port is a non-private AP attribute port, so 20 points are subtracted from the benchmark score of 100 points. The allocated network segment has a small range and does not reach 255, so 20 points are subtracted from the benchmark score. The MAC address 5c:ad:cf:46:b8:af is the same as the preset MAC address of the AP to be detected, so it is not necessary to subtract the score corresponding to the MAC address. The page content of the AP management page and the page content of the AP login page are not described in detail here, and the page content of the AP management page and the page content of the AP login page and the page content of the preset secure AP management page are The content of the page of the secure AP login page is the same, so you do not need to subtract the page content of the AP management page and the score corresponding to the page content of the AP login page.

Therefore, the safety score = 100-20-20-20 = 40.

Since the security score does not reach the preset score of 80 points, it is determined that the AP to be detected is at risk.

In addition, for the type of the AP being a company AP, the security score is calculated in a manner similar to that described above, and compared with the preset score corresponding to the company AP. Based on the above description, a person skilled in the art can obtain a specific implementation manner of the detecting company AP without paying creative labor, and details are not described herein again.

Based on the same disclosure concept as the AP risk detection method in the foregoing embodiment, the second aspect of the present disclosure further provides a schematic structural diagram of an AP risk detection apparatus, as shown in FIG. 2, including:

The first determining module 101 is configured to determine, according to the type of the wireless access point AP to be detected, a target parameter type of the AP to be detected and a security test plan, where the security test solution includes calculating a parameter to be detected based on the parameter of the target parameter type The calculation scheme of the security score of the AP and the preset score indicating the security of the AP to be detected; wherein the parameter types and security test schemes corresponding to the types of different APs are not completely the same;

The first obtaining module 102 is configured to detect the AP to be detected according to the target parameter type, and obtain a first parameter of the target parameter type;

The calculating module 103 is configured to calculate a safety score of the AP to be detected based on the first parameter and the calculation scheme;

The determining module 104 is configured to determine whether the security score of the AP to be detected reaches a preset score;

The second determining module 105 is configured to determine that the AP to be detected is at risk when the security score of the AP to be detected does not reach the preset score.

Further, the device in the embodiment of the present disclosure further includes:

a second obtaining module, configured to: before determining a target parameter type of the AP to be detected that needs to be obtained and a security test solution, detecting the AP to be detected, and obtaining a second parameter indicating a type of the AP to be detected;

The third determining module is configured to determine a type of the AP to be detected based on the second parameter.

Specifically, when the type of the AP to be detected is a public AP, the target parameter type includes at least an AP operating system and an AP open port, where the first parameter is the first operating system and the first open port, and the calculating module 104 is configured to determine that the AP is to be detected. Whether the first operating system of the AP is a user terminal system; when the first operating system of the AP to be detected is a user terminal system, the score corresponding to the AP operating system is subtracted from the public AP reference score; and the first AP to be detected is determined. Whether the user terminal port is included in the open port; when the first issuing port of the AP to be detected includes the user terminal port, the score corresponding to the AP open port is subtracted from the public AP reference point.

Or, specifically, when the type of the AP to be detected is a private AP, the target parameter type includes at least an AP open port and a historical connection user, and the first parameter is the second port and the second user, and the calculating module 104 is configured to determine that the AP is to be detected. Whether the non-private AP attribute port is included in the second port of the AP; when the second open port of the AP to be detected includes the non-private AP attribute port, the score corresponding to the AP open port is subtracted from the private AP reference point; Whether the second user includes the user who does not have the right to connect to the AP to be detected; when the second user of the AP to be detected includes the user who does not have the right to connect to the AP to be detected, the corresponding point of the historical connection user is subtracted from the private AP reference score. value.

The various changes and specific examples of the method for detecting the AP risk in the foregoing embodiment of FIG. 1 are also applicable to the device for detecting the AP risk in the embodiment. The foregoing detailed description of the method for detecting the AP risk may be used by those skilled in the art. The implementation method of the apparatus for AP risk detection in this embodiment is clearly known, so that the details of the description will not be described in detail herein.

A third aspect of the present disclosure provides a computer program, and FIG. 3 illustrates a computing device that can implement the method of AP risk detection in accordance with the present disclosure. The computing device traditionally includes a processor 310 and a computer program product or computer readable medium in the form of a storage device 320. The storage device 320 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. Storage device 320 has a storage space 330 that stores program code 331 for performing any of the method steps described above. For example, storage space 330 storing program code may include various program code 331 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as a hard disk, a compact disk (CD), a memory card, or a floppy disk. Such computer program products are typically portable or fixed storage units such as those shown in FIG. The storage unit may have storage segments, storage spaces, and the like that are similarly arranged to storage device 320 in the computing device of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 331' for performing the method steps in accordance with the present disclosure, ie, code that can be read by a processor, such as 310, which when executed by the computing device causes the computing device Perform the various steps in the method described above.

The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the teaching based on the teachings herein. From the above description, the structure required to construct such a system is obvious. Moreover, the present disclosure is not directed to any particular programming language. It is to be understood that the subject matter of the present disclosure, which is described herein, may be described in a particular language.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the present disclosure may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

In the description of the exemplary embodiments of the present disclosure, the various features of the present disclosure are sometimes grouped together into a single embodiment, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as disclosed in the following claims, the disclosed aspects are less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the specific embodiments, and each of the claims as a separate embodiment of the present disclosure.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.

In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features that are included in other embodiments and not in other features, combinations of features of different embodiments are intended to be within the scope of the present disclosure. And different embodiments are formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

Various component embodiments of the present disclosure may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of some or all of the gateways, proxy servers, systems in accordance with embodiments of the present disclosure. The present disclosure may also be implemented as a device or device program (eg, a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the present disclosure may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

It should be noted that the above-described embodiments are illustrative of the present disclosure and are not intended to limit the scope of the disclosure, and those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" The present disclosure can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

Claims

A method for AP risk detection, comprising:

Determining, according to the type of the wireless access point AP to be detected, a target parameter type of the AP to be detected and a security test plan, where the security test plan includes calculating the AP to be detected based on the parameter of the target parameter type. a calculation scheme of the security score and a preset score indicating the security of the AP to be detected; wherein the parameter types and security test schemes corresponding to the types of different APs are not completely the same;

Detecting the to-be-detected AP according to the target parameter type, and obtaining a first parameter of the target parameter type;

Calculating a security score of the AP to be detected based on the first parameter and the calculation scheme;

Determining whether the security score of the AP to be detected reaches the preset score;

When the security score of the AP to be detected does not reach the preset score, it is determined that the AP to be detected has a risk.
The method according to claim 1, wherein before determining the target parameter type of the AP to be detected and the security test plan, the method further includes:

Detecting the to-be-detected AP, and obtaining a second parameter indicating a type of the to-be-detected AP;

Determining the type of the AP to be detected based on the second parameter.
The method according to claim 2, wherein the type of the AP to be detected is at least one of a public AP or a private AP.
The method according to claim 3, wherein when the type of the AP to be detected is the public AP, the target parameter type includes at least an AP operating system and an AP open port, and the first parameter is An operating system and a first open port, based on the first parameter and the computing solution, calculate a security score of the AP to be detected, including:

Determining whether the first operating system of the AP to be detected is a user terminal system;

When the first operating system of the AP to be detected is a user terminal system, the score corresponding to the AP operating system is subtracted from the public AP reference score;

Determining whether the user terminal port is included in the first open port of the AP to be detected;

When the first issuing port of the to-be-detected AP includes the user terminal port, the score corresponding to the AP open port is subtracted from the common AP reference point.
The method according to claim 3, wherein when the type of the AP to be detected is a private AP, the target parameter type includes at least an AP open port and a historical connection user, and the first parameter is a second port. And calculating, by the second user, the security score of the AP to be detected, based on the first parameter and the calculation scheme, including:

Determining whether the second port of the to-be-detected AP includes a non-private AP attribute port;

When the second open port of the to-be-detected AP includes a non-private AP attribute port, the score corresponding to the AP open port is subtracted from the private AP reference point;

Determining whether the second user includes a user who does not have the right to connect to the AP to be detected;

When the second user of the AP to be detected includes a user who does not have the right to connect to the AP to be detected, the score corresponding to the historical connection user is subtracted from the private AP reference score.
An apparatus for detecting an AP risk, comprising:

a first determining module, configured to determine, according to a type of the wireless access point AP to be detected, a target parameter type of the AP to be detected and a security test solution, where the security test solution includes a parameter indicating the target parameter type a calculation scheme of the security score of the AP to be detected and a preset score indicating the security of the AP to be detected; wherein the parameter types and security test schemes corresponding to the types of different APs are not completely the same;

a first obtaining module, configured to detect the to-be-detected AP according to the target parameter type, and obtain a first parameter of the target parameter type;

a calculation module, configured to calculate a security score of the AP to be detected based on the first parameter and the calculation scheme;

a determining module, configured to determine whether the security score of the AP to be detected reaches the preset score;

The second determining module is configured to determine that the AP to be detected has a risk when the security score of the AP to be detected does not reach the preset score.
The device of claim 6 wherein said device further comprises:

a second obtaining module, configured to detect the AP to be detected, and obtain a second parameter indicating a type of the AP to be detected, before determining a target parameter type of the AP to be detected and a security test plan

And a third determining module, configured to determine, according to the second parameter, a type of the AP to be detected.
The apparatus according to claim 7, wherein the type of the AP to be detected is at least one of a public AP or a private AP.
The device according to claim 8, wherein when the type of the AP to be detected is the public AP, the target parameter type includes at least an AP operating system and an AP open port, and the first parameter is An operating system and a first open port, the computing module is configured to determine whether the first operating system of the AP to be detected is a user terminal system; and when the first operating system of the AP to be detected is a user terminal In the system, the score corresponding to the AP operating system is subtracted from the public AP reference score; determining whether the first open port of the AP to be detected includes a user terminal port; and when the first to be detected is the first When the user terminal port is included in the issuing port, the score corresponding to the AP open port is subtracted from the public AP reference point.
The device according to claim 8, wherein when the type of the AP to be detected is a private AP, the target parameter type includes at least an AP open port and a historical connection user, and the first parameter is a second port. And the second user, the calculating module is configured to determine whether the second port of the to-be-detected AP includes a non-private AP attribute port; and when the second open port of the to-be-detected AP includes a non-private AP The attribute port is obtained by subtracting the score corresponding to the AP open port from the private AP reference point; determining whether the second user includes a user who does not have the right to connect to the AP to be detected; when the to-be-detected When the second user of the AP includes a user who does not have the right to connect to the AP to be detected, the score corresponding to the historical connection user is subtracted from the private AP reference score.
A computer program comprising computer readable code, when the computer readable code is run on a computing device, causing the computing device to perform the AP risk detection method of any of claims 1-5 .
A computer readable medium storing the computer program of claim 11.