WO2018113728A1

WO2018113728A1 - Method and device for determining risk of phishing attack in public wifi network

Info

Publication number: WO2018113728A1
Application number: PCT/CN2017/117690
Authority: WO
Inventors: 张建新; 高永岗; 刘天
Original assignee: 北京奇虎科技有限公司
Priority date: 2016-12-21
Filing date: 2017-12-21
Publication date: 2018-06-28
Also published as: CN106454847A

Abstract

The embodiments of the invention provide a method and device for determining a risk of phishing attacks in a public WiFi network. The method comprises: obtaining information obtained by user equipment (UE) performing detection on an access point (AP) in a public wireless fidelity (WiFi) network, wherein the obtained information comprises a target service set identifier (SSID) and a target medium access control (MAC) information of the AP; determining, on the basis of a pre-stored MAC information reference library, whether the target MAC information is consistent with secure MAC information corresponding to the target SSID recorded in the MAC information reference library, wherein the target SSID corresponds to one or more secure MAC information; and if not, determining that a risk of phishing attacks is present in the public WiFi network.

Description

Method and device for detecting public WiFi fishing risk

Cross-reference to related applications

The present application claims priority to Chinese Patent Application No. 201611191620.3, entitled "Detecting Method and Apparatus for Public WiFi Fishing Risk", which is filed on December 21, 2016, the entire contents of which are incorporated by reference. In this application.

Technical field

The present disclosure relates to the field of computer technologies, and in particular, to a method and apparatus for detecting a public WiFi phishing risk.

Background technique

With the increase and popularity of public WiFi (Wireless-Fidelity), the security of public WiFi has become more and more serious. According to statistics, 66% of public WiFi is currently not secure enough. The criminals will copy the phishing WiFi into a public WiFi, causing damage to property and privacy after the user accesses the phishing WiFi.

In the related art, a solution to the phishing risk of the public WiFi is to deploy a WIDS (Wireless Intrusion Detection Systems) detection device within a certain range, and use the WIDS detection device to detect the phishing WiFi in the coverage.

However, the above method of detecting phishing risk must rely on hardware deployment (ie, WIDS detection device) other than the Internet device (such as user equipment, gateway device, server, etc.).

Summary of the invention

The embodiment of the present disclosure provides a method and device for detecting a public WiFi phishing risk, which is used to implement a technical effect of performing phishing risk detection on a public WiFi without relying on additional hardware deployment.

In a first aspect, the present disclosure provides a method for detecting a public WiFi phishing risk, including:

Obtaining information obtained by the user equipment UE detecting the wireless access point AP of the public wireless fidelity WiFi, and the obtained information includes the target service set identifier SSID of the AP and the target media access control MAC information of the AP;

Determining, according to the pre-stored MAC information reference library, whether the target MAC information is consistent with one secure MAC information corresponding to the target SSID recorded by the MAC information reference library, and the secure MAC information corresponding to the target SSID is one or more;

When the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID recorded by the MAC information reference library, it is determined that the public WiFi has a phishing risk.

In a second aspect, the present disclosure provides a device for detecting a public WiFi phishing risk, including:

And an obtaining module, configured to obtain information obtained by detecting, by the user equipment UE, a wireless access point AP of the public wireless fidelity WiFi, where the obtained information includes a target service set identifier SSID of the AP and target media access control MAC information of the AP;

a determining module, configured to determine, according to the pre-stored MAC information reference library, whether the target MAC information is consistent with a secure MAC information corresponding to the target SSID recorded by the MAC information reference library, and the secure MAC information corresponding to the target SSID is one or more;

The determining module is configured to determine that the public WiFi has a phishing risk when the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID recorded by the MAC information reference library.

In a third aspect, the present disclosure provides a computer program comprising:

Computer readable code, when the computer readable code is run on a computing device, causes the computing device to perform the method of detecting the public WiFi phishing risk described above.

In a fourth aspect, the present disclosure provides a computer readable medium, comprising:

A computer program for performing the above-described method of detecting the public WiFi phishing risk is stored.

The above one or more technical solutions in the embodiments of the present disclosure have at least one or more of the following technical effects:

In the technical solution of the embodiment of the present disclosure, information obtained by the user equipment UE detecting the wireless access point AP of the WiFi is first obtained, and the obtained information includes the target service set identifier SSID of the AP and the target media access control MAC of the AP. And then determining, according to the pre-stored MAC information reference library, whether the target MAC information is consistent with a secure MAC information corresponding to the target SSID recorded by the MAC information reference library, and the secure MAC information corresponding to the target SSID includes one or more, when the target When the MAC information is inconsistent with any secure MAC information corresponding to the target SSID recorded by the MAC information reference library, it is determined that the public WiFi has a phishing risk. Therefore, in the case that no additional hardware deployment is required, whether the target MAC information of the public WiFi is consistent with the secure MAC information corresponding to the target SSID recorded in the MAC information reference library, and then the public WiFi is used. The risk of fishing is tested. Therefore, the technical problem that the prior art can only detect the phishing risk through additional hardware deployment is solved, and the technical effect of detecting the public WiFi without relying on additional hardware deployment is realized, thereby reducing the cost of public WiFi security maintenance.

BRIEF abstract

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

1 is a flowchart of a method for detecting a public WiFi phishing risk in an embodiment of the present disclosure;

2 is a schematic structural diagram of a device for detecting a public WiFi phishing risk according to an embodiment of the present disclosure;

3 schematically illustrates a block diagram of a computing device for performing a method of detecting a public WiFi phishing risk in accordance with an embodiment of the present disclosure; and FIG. 4 schematically illustrates an implementation for maintaining or carrying implementations in accordance with an embodiment of the present disclosure. The storage unit of the program code of the public WiFi fishing risk detection method.

Preferred embodiment of the invention

In order to solve the above technical problems, the technical solutions provided by the present disclosure are as follows:

In the technical solution of the embodiment of the present disclosure, information obtained by the user equipment UE detecting the wireless access point AP of the WiFi is first obtained, and the obtained information includes the target service set identifier SSID of the AP and the target media access control MAC of the AP. And then determining, according to the pre-stored MAC information reference library, whether the target MAC information is consistent with a secure MAC information corresponding to the target SSID recorded by the MAC information reference library, and the secure MAC information corresponding to the target SSID includes one or more, when the target When the MAC information is inconsistent with any secure MAC information corresponding to the target SSID recorded by the MAC information reference library, it is determined that the public WiFi has a phishing risk. Therefore, in the case that no additional hardware deployment is required, the phishing risk of the public WiFi is detected by comparing whether the target MAC information of the public WiFi is consistent with the secure MAC information corresponding to the target SSID recorded in the MAC information reference library. Therefore, the prior art can only detect the fishing through additional hardware deployment. The technical problem of risk realizes the technical effect of detecting public WiFi without relying on additional hardware deployment, thereby reducing the cost of public WiFi security maintenance.

The technical solutions of the present disclosure are described in detail below with reference to the accompanying drawings and specific embodiments. It is understood that the specific features of the embodiments and the embodiments of the present disclosure are the detailed description of the technical solutions of the present disclosure, and In the case of no conflict, the technical features of the embodiments of the present disclosure and the embodiments may be combined with each other.

The term "and/or" in this context is merely an association describing the associated object, indicating that there may be three relationships, for example, A and / or B, which may indicate that A exists separately, and both A and B exist, respectively. B these three situations. In addition, the character "/" in this article generally indicates that the contextual object is an "or" relationship.

A first aspect of the present disclosure provides a method for detecting a public WiFi phishing risk. Referring to FIG. 1 , it is a flowchart of a method for detecting a public WiFi phishing risk according to an embodiment of the present disclosure. The method includes:

S101: Obtain information obtained by detecting, by the user equipment UE, a wireless access point AP of the public wireless fidelity WiFi, where the obtained information includes a target service set identifier SSID of the AP and target media access control MAC information of the AP;

S102: Determine, according to the pre-stored MAC information reference library, whether the target MAC information is consistent with one secure MAC information corresponding to the target SSID recorded by the MAC information reference library, and the security MAC information corresponding to the target SSID is one or more;

S103: When any one of the secure MAC information corresponding to the target SSID recorded by the MAC information reference database is inconsistent, it is determined that the public WiFi has a phishing risk.

Specifically, the public WiFi in the embodiment of the present disclosure refers to an AP (Access Point) whose security attribute is OPEN, such as CMCC-WEB, ChinaNet, ChinaUnicom, and 16WiFi.

The executor of the method for detecting the public WiFi phishing risk in the S101 to S103 in the embodiment of the present disclosure may be a UE (User Equipment) or a server connected to the UE, and the disclosure is not specifically limited.

When the phishing risk of a public WiFi is detected, the UE obtains information by detecting the AP of the public WiFi, and the information obtained in the embodiment of the present disclosure specifically includes the SSID (Service Set Identifier) of the AP. And the MAC (Media Access Control, Media Access Control or Medium Access Control) information of the AP. Implemented in the present disclosure For example, the target SSID is the SSID of the AP, and the target MAC information is the MAC information of the AP. The MAC information is, for example, a MAC address and a MAC manufacturer, and the like, and the present disclosure is not specifically limited.

The phishing risk detection of the public WiFi may be specifically performed when the UE accesses the public WiFi, or when the UE accesses the new public WiFi, that is, when the public WiFi is different from the historical public WiFi SSID. . The person skilled in the art to which the present disclosure pertains may make selections according to actual conditions, and the present disclosure is not specifically limited.

For the execution subject being the UE, the target SSID and the target MAC information are obtained in S101, specifically, the SS ID and MAC information of the AP of the public WiFi to be detected are detected by the UE, and the target SSID is obtained in S101 for the execution subject as the server. The target MAC information is specifically the SSID and MAC information reported by the receiving UE after detecting the AP.

After obtaining the target SSID and the target MAC information, executing S102, determining, according to the pre-stored MAC information reference library, whether the target MAC information is one of the one or more secure MAC information corresponding to the target SSID recorded in the MAC information reference library. The information is consistent.

Specifically, the MAC information reference library in the embodiment of the present disclosure records a plurality of SSIDs of the public WiFi, and secure MAC information corresponding to each SSID. For example, assume that the MAC information reference library records four SSIDs of CMCC-WEB, ChinaNet, ChinaUnicom, and 16WiFi, and secure MAC information corresponding to each SSID.

In the embodiment of the present disclosure, the MAC information reference library may be established and maintained by the UE itself, or may be established and maintained by the server. Preferably, in order to obtain a more comprehensive and more accurate MAC information reference library, it is better for the server to establish and maintain a MAC information reference library based on big data. Of course, if the execution subject in the embodiment of the present disclosure is the UE, the UE also needs to send an acquisition request to the server to request to obtain the MAC information reference library, and then receive the MAC information reference library delivered by the server based on the acquisition request, and then The MAC information base stock is stored in the storage space of the UE.

In order to perform phishing risk detection on the public WiFi, one or more secure MAC information corresponding to the target SSID is searched from the MAC information reference library based on the target SSID. Then, one or more secure MAC information corresponding to the target SSID and the target SSID are compared. If the target MAC information is consistent with one of the secure MAC information, it indicates that the target MAC information is secure, and thus the possibility that the public WiFi has a phishing risk is small, so it is determined that the public WiFi does not exist for fishing. risk. On the other hand, if the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID, it indicates that the public WiFi may be insecure, and in S103, it is determined that the public WiFi has a phishing risk.

Through the above process, the detection of the public WiFi phishing risk is realized. It can be seen from the above description that the method for detecting the public WiFi phishing risk of the embodiment of the present disclosure does not require additional hardware deployment, and compares whether the target MAC information of the public WiFi is consistent with the secure MAC information corresponding to the target SSID recorded in the MAC information reference library. And then detect the phishing risk of public WiFi. Therefore, the technical problem that the prior art can only detect the phishing risk through additional hardware deployment is solved, and the technical effect of detecting the public WiFi without relying on additional hardware deployment is realized, thereby reducing the cost of public WiFi security maintenance.

In the specific implementation process, since the storage MAC information reference library occupies a large storage resource, comparing the target MAC information with a large amount of secure MAC information also consumes a large amount of memory resources and power, therefore, considering the UE storage resources and memory. The resources and power are limited, and therefore, it is preferable that the server performs the detection of the public WiFi phishing risk in the embodiment of the present disclosure.

Further, since the target MAC information can have multiple possibilities, the specific implementation manner of the S102 is also various. Some of them are described in detail below.

The first:

In the first implementation, the target MAC information specifically includes the target MAC address, and the MAC information also includes the secure MAC address, and the S102 is implemented by the following process:

Determining whether the target MAC address is consistent with a secure MAC address corresponding to the target SSID recorded by the MAC information reference library;

Wherein, when the target MAC address is inconsistent with any one of the secure MAC addresses, it indicates that the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID of the MAC information reference record.

Specifically, based on the target SSID, one or more secure MAC addresses corresponding to the target SSID are searched from the MAC information reference library, and then the target MAC address and the secure MAC address corresponding to the target SSID are compared. Generally, the MAC address of each Internet access device is unique. Therefore, if the destination MAC address is consistent with one of the secure MAC addresses, it indicates that the AP device is configured by the public WiFi carrier, so the public WiFi is less likely to have a phishing risk. . Therefore, when the target MAC address is consistent with one of the secure MAC addresses corresponding to the target SSID, The standard MAC information is consistent with one of the secure MAC information corresponding to the target SSID of the MAC information reference record, thereby determining that there is no phishing risk in the public WiFi. On the other hand, if all the secure MAC addresses of the target MAC address and the target SSID are inconsistent, it means that the AP device may not be configured by the public WiFi operator, so the public WiFi has a phishing risk. Therefore, when the target MAC address is inconsistent with any one of the secure MAC addresses of the target SSID, it indicates that the target MAC information is inconsistent with all the secure MAC information corresponding to the target SSID of the MAC information reference record, and it is determined that the public WiFi has a phishing risk.

For example, the target SSID is specifically ****-WEB, and the secure MAC address of the ****-WEB recorded in the MAC information reference library is as shown in Table 1.

Table 1

Assume that the destination MAC address is 58:66:ba:6e:57:20. Since the target MAC address is consistent with the secure address 58:66:ba:6e:57:20, it is determined that there is no phishing risk for the public WiFi. Assume that the target MAC address is 5c:ad:cf:46:b8:ae. Since the target MAC address is inconsistent with the secure MAC address in Table 1, it is determined that the public WiFi has a phishing risk.

Further, in a specific implementation process, there may be a case where the MAC address is duplicated. In order to distinguish different MAC addresses with the same address, the MAC information reference library may simultaneously record the coordinates of each secure MAC address when recording the secure MAC address. To distinguish between duplicate MACs. For example, 58:66:ba:6e:57:20 (coordinates: Beijing) and 58:66:ba:6e:57:20 (coordinates: Shanghai). Further, in S101, the coordinates of the AP are further acquired. When the target MAC address and one of the MAC addresses corresponding to the target SSID are consistent, it is further determined whether the coordinates of the target MAC address are consistent with the coordinates of the consistent secure MAC address. If the coordinates of the destination MAC address are the same If the coordinates of the secure MAC address are inconsistent, it means that the AP corresponding to the target MAC address is not the secure AP indicated by the same secure MAC address, so it is still determined that the public WiFi has a phishing risk.

Second:

In the second implementation manner, the target MAC information specifically includes the target MAC manufacturer, and the secure MAC information specifically includes the secure MAC manufacturer, and then S102 is implemented by the following process:

Determining whether the target MAC manufacturer is consistent with a secure MAC manufacturer corresponding to the target SSID recorded in the MAC information reference library;

Wherein, when the target MAC manufacturer is inconsistent with any of the secure MAC producers, it indicates that the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID of the MAC information reference record.

Specifically, the MAC manufacturer in the embodiment of the present disclosure refers to a company or manufacturer that produces an AP device or an AC (Access Control) device. Based on the target SSID, one or more secure MAC producers corresponding to the target SSID are searched from the MAC information reference library, and then the target MAC producer and the secure MAC producer corresponding to the target SSID are compared. Since, in general, operators of public WiFi purchase large quantities of AP equipment or AC equipment produced by one or more manufacturers, the probability of individual procurement is small, and the probability of these manufacturers producing phishing AP equipment or AC equipment for criminals is low. It is also small, so if the target MAC producer is consistent with one of the secure MAC producers, it means that the AP device is configured by the public WiFi operator, so the public WiFi is less likely to have a phishing risk. Therefore, when the target MAC manufacturer is consistent with one of the secure MAC producers of the target SSID, it indicates that the target MAC information is consistent with the target SSID of the MAC information reference record, and it is determined that there is no phishing risk in the public WiFi. On the other hand, if the target MAC manufacturer is inconsistent with any secure MAC manufacturer corresponding to the target SSID, it means that the AP device may not be configured by the public WiFi operator, so the public WiFi has a risk of phishing. Therefore, when the target MAC manufacturer is inconsistent with any of the secure MAC producers corresponding to the target SSID, all the secure MAC information corresponding to the target SS information and the target SSID of the MAC information reference record are inconsistent, and it is determined that the public WiFi has a fishing risk. .

As an example of the target SSID specifically ****-WEB, the secure MAC producer of the ****-WEB recorded in the MAC information reference library is as shown in Table 2.

Table 2

Assume that the target MAC producer is Hangzhou H3C Technologies Co. Since the target MAC manufacturer is consistent with the secure MAC manufacturer Hangzhou H3C Technologies Co., it is determined that there is no phishing risk for the public WiFi. Assuming that the target MAC address producer is ABC, since the target MAC producer is inconsistent with the secure MAC producer in Table 2, it is determined that the public WiFi has a phishing risk.

The third type:

In combination with the first implementation manner, in the third implementation manner, the target MAC information further includes a target MAC manufacturer, and the secure MAC information further includes a secure MAC manufacturer. When the target MAC address is inconsistent with one or more secure MAC addresses, the implementation process of S102 further includes:

Wherein, when the target MAC address is inconsistent with any one of the secure MAC addresses, and the target MAC manufacturer is also inconsistent with any of the secure MAC manufacturers, the target MAC information is any one of the secure MAC addresses corresponding to the target SSID of the MAC information reference record. The information is inconsistent.

Specifically, in the third implementation manner, the target MAC information specifically includes the target MAC address and the target MAC manufacturer, and the secure MAC information also includes the secure MAC address and the secure MAC manufacturer. In the third implementation manner, it is first determined whether the target MAC address is consistent with one of the secure MAC addresses corresponding to the target SSID. If the target MAC address is consistent with one of the secure MAC addresses corresponding to the target SSID, it is determined that there is no phishing risk in the public WiFi. The specific process of determining whether the target MAC address is consistent with the secure MAC address corresponding to the target SSID has been introduced in the first implementation manner, so the similarities between the first implementation manner and the third implementation manner are no longer Repeat it.

The third implementation differs from the first implementation in that when all the secure MAC addresses corresponding to the target MAC address are inconsistent, the public WiFi is not confirmed to have a phishing risk, but the target MAC production is further determined. Whether the vendor is consistent with one of the secure MAC producers corresponding to the SSID. When the target MAC producer is also inconsistent with all secure MAC producers, it will be determined that the public WiFi has a phishing risk.

Specifically, since the reference library may not record the secure MAC address corresponding to all the target SSIDs, or the new secure MAC address of the target SSID is not recorded in time, all the secure MAC addresses of the target MAC address and the target SSID are Inconsistent, further verify that the target MAC manufacturer is a secure MAC producer.

Since most AP devices or AC devices produced by the secure MAC manufacturer are secure, all secure MAC addresses corresponding to the target SSID and the target SSID are inconsistent, but one of the target MAC producers corresponds to the target SSID. When the business is consistent, public WiFi is still considered safe. When the target MAC address is inconsistent with all the secure MAC addresses corresponding to the target SSID, the target MAC manufacturer also has all the secure MAC addresses corresponding to the target SSID. When the producers are inconsistent, it will be determined that there is a risk of fishing in public WiFi. Thereby, the detection accuracy of the public WiFi fishing risk is improved.

Further, for the third implementation manner, the method may further include:

When the target MAC address is inconsistent with any one of the secure MAC addresses, and the target MAC manufacturer is consistent with a secure MAC manufacturer, the target MAC address is recorded as the secure MAC address corresponding to the target SSID.

Specifically, when the target MAC address is inconsistent with one or more secure MAC addresses, and the target MAC manufacturer is consistent with one of the secure MAC producers, it indicates that the target MAC address is missing from the MAC information reference library. The target MAC address is added as a secure MAC address corresponding to the target SSID.

Fourth:

With reference to the first implementation manner and the second implementation manner, in the fourth implementation manner, the target MAC information specifically includes the target MAC address and the target MAC manufacturer, and the secure MAC information specifically includes the secure MAC address and the secure MAC producer, S102. The implementation process is as follows:

Determining whether the target MAC address is consistent with a secure MAC address corresponding to the target SSID recorded by the MAC information reference library, and whether the target MAC manufacturer is consistent with a secure MAC producer corresponding to the SSID;

Wherein, when the target MAC address is inconsistent with any secure MAC address, and the target MAC manufacturer is also inconsistent with any secure MAC manufacturer, the target MAC information is inconsistent with any secure MAC information corresponding to the target SSID of the MAC information reference record. .

In the fourth implementation, the target MAC address and the target MAC manufacturer will be verified simultaneously. In the specific implementation process, it may first determine whether the target MAC address is consistent with one of the secure MAC addresses corresponding to the target SSID, and then determine whether the target MAC manufacturer is consistent with one of the secure MAC producers corresponding to the target SSID, or first determine the target MAC production. Whether the quotient is consistent with one of the secure MAC producers corresponding to the target SSID, and then determining whether the target MAC address is consistent with one of the secure MAC addresses of the target SSID, or simultaneously performing the above two independent determinations, the disclosure does not specifically limit.

The details of the fourth implementation being the same as the first implementation and the second implementation are not repeated.

The fourth implementation differs from the first implementation and the second implementation in that The public WiFi security is determined when the target MAC address is consistent with one of the secure MAC addresses of the target SSID, or the target MAC producer is consistent with one of the secure MAC producers of the target SSID. When all the secure MAC addresses corresponding to the target MAC address and the target SSID are inconsistent, and the target MAC producers are also inconsistent with all the secure MAC producers corresponding to the target SSID, it is determined that the public WiFi has a phishing risk. Thereby, the detection accuracy of the public WiFi fishing risk is improved.

In the specific implementation process, any one of the above five implementation manners may be selected by a person of ordinary skill in the art according to the actual implementation, and the disclosure is not specifically limited.

The following describes how the server establishes a MAC information reference library.

First, the server sends a report command to the multiple UEs of the access server, where the report is used to notify each UE to detect the accessed AP, obtain the access AP information, and report the detected AP information to the server. The AP information includes at least the security attribute, the SSID, and the MAC information, and further includes the coordinates of the AP, etc., and the disclosure does not specifically limit the disclosure. Further, the server obtains a large amount of AP information by reporting the multiple UEs. Further, the server administrator can also obtain AP information from operators of different public WiFi.

Then, based on the security attributes in each AP information, the server filters out the AP whose security attribute is OPEN, that is, filters public WiFi from a large number of WiFi. In addition, the AP information with the same content needs to be subjected to deduplication processing, so that there is no AP information with the same content in the remaining AP information. And, by detecting and verifying, the secure AP information of the secure AP is filtered out from the AP information of a large number of public WiFi.

Next, all the secure AP information are clustered according to the SSID, thereby obtaining secure MAC information such as a secure MAC address, a secure MAC producer, and coordinates corresponding to each SSID. Then, the secure MAC information corresponding to each SSID is recorded, and a MAC information reference library is established.

Further, in order to store the storage resources occupied by the MAC information reference library, the number of each SSID is further obtained, and the ranking from high to low is performed according to the number of each SSID. Then, only the SSID sorted before the preset sorting and the corresponding secure MAC information are recorded in the MAC information reference library. In other words, since the probability of accessing the less common public WiFi is smaller in the specific implementation process, only the SSID of the public WiFi with a relatively high coverage rate and a large number of public WiFi addresses may be recorded in the MAC information reference library and corresponding MAC security information.

Further, you can also calculate the proportion of each secure MAC producer for each SSID. The safe MAC producers with higher proportions are recorded in the MAC security reference library, and the safe MAC producers with lower proportions are not recorded.

Further, when the server maintains the MAC information reference library, the server may also receive user correction information reported by the UE, and then add, delete, or modify the security MAC information based on the user correction information.

Based on the same disclosure concept as the method for detecting the public WiFi phishing risk in the foregoing embodiment, the second aspect of the present disclosure further provides a device for detecting a public WiFi phishing risk, as shown in FIG. 2, including:

The obtaining module 101 is configured to obtain information obtained by detecting, by the user equipment UE, the wireless access point AP of the public wireless fidelity WiFi, where the obtained information includes the target service set identifier SSID of the AP and the target media access control MAC information of the AP. ;

The determining module 102 is configured to determine, according to the pre-stored MAC information reference library, whether the target MAC information is consistent with one secure MAC information corresponding to the target SSID recorded by the MAC information reference database, and the secure MAC information corresponding to the target SSID is one or more;

The determining module 103 is configured to determine that the public WiFi has a phishing risk when the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID recorded by the MAC information reference library.

Specifically, the target MAC information includes a target MAC address, and the secure MAC information includes a secure MAC address, and the determining module 102 is configured to determine whether the target MAC address is consistent with a secure MAC address corresponding to the target SSID recorded by the MAC information reference library;

Alternatively, the target MAC information includes a target MAC manufacturer, the secure MAC information includes a secure MAC manufacturer, and the determining module 102 is configured to determine whether the target MAC manufacturer is consistent with a secure MAC producer corresponding to the target SSID recorded by the MAC information reference library;

Further, the target MAC information also includes the target MAC manufacturer, and the secure MAC information also includes the secure MAC manufacturer, when the target MAC address is inconsistent with any of the secure MAC addresses. The determining module 102 is further configured to determine whether the target MAC manufacturer is consistent with a secure MAC manufacturer corresponding to the target SSID recorded by the MAC information reference library;

Further, the device in the embodiment of the present disclosure further includes:

The recording module is configured to record the target MAC address as the secure MAC address corresponding to the target SSID when the target MAC address is inconsistent with any one of the secure MAC addresses, and the target MAC manufacturer is consistent with a secure MAC manufacturer.

The various changes and specific examples of the method for detecting the public WiFi phishing risk in the foregoing embodiment of FIG. 1 are also applicable to the public WiFi phishing risk detecting apparatus of the present embodiment, and the foregoing detailed description of the method for detecting the public WiFi phishing risk is described. The method for implementing the detection device of the public WiFi phishing risk in this embodiment can be clearly understood by those skilled in the art, so that the details of the description will not be described in detail herein.

A third aspect of the present disclosure provides a computer program, and FIG. 3 illustrates a computing device that can implement a method of detecting a public WiFi phishing risk in accordance with the present disclosure. The computing device traditionally includes a processor 310 and a computer program product or computer readable medium in the form of a storage device 320. The storage device 320 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. Storage device 320 has a storage space 330 that stores program code 331 for performing any of the method steps described above. For example, storage space 330 storing program code may include various program code 331 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as a hard disk, a compact disk (CD), a memory card, or a floppy disk. Such computer program products are typically portable or fixed storage units such as those shown in FIG. The storage unit may have storage segments, storage spaces, and the like that are similarly arranged to storage device 320 in the computing device of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 331' for performing the method steps in accordance with the present disclosure, ie, code that can be read by a processor, such as 310, which when executed by the computing device causes the computing device Execution The various steps in the method described.

In the technical solution of the embodiment of the present disclosure, information obtained by the user equipment UE detecting the wireless access point AP of the WiFi is first obtained, and the obtained information includes the target service set identifier SSID of the AP and the target media access control MAC of the AP. And then determining, according to the pre-stored MAC information reference library, whether the target MAC information is consistent with a secure MAC information corresponding to the target SSID recorded by the MAC information reference library, and the secure MAC information corresponding to the target SSID includes one or more, when the target When the MAC information is inconsistent with any secure MAC information corresponding to the target SSID recorded by the MAC information reference library, it is determined that the public WiFi has a phishing risk. Therefore, in the case that no additional hardware deployment is required, the phishing risk of the public WiFi is detected by comparing whether the target MAC information of the public WiFi is consistent with the secure MAC information corresponding to the target SSID recorded in the MAC information reference library. Therefore, the technical problem that the prior art can only detect the phishing risk through additional hardware deployment is solved, and the technical effect of detecting the public WiFi without relying on additional hardware deployment is realized, thereby reducing the cost of public WiFi security maintenance.

The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the teaching based on the teachings herein. The structure required to construct such a system is apparent from the above description. Moreover, the present disclosure is not directed to any particular programming language. It is to be understood that the subject matter of the present disclosure, which is described herein, may be described in a particular language.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the present disclosure may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

In the description of the exemplary embodiments of the present disclosure, the various features of the present disclosure are sometimes grouped together into a single embodiment, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as disclosed in the following claims, the disclosed aspects are less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the specific embodiments, The requirements themselves are a separate embodiment of the present disclosure.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.

In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features that are included in other embodiments and not in other features, combinations of features of different embodiments are intended to be within the scope of the present disclosure. And different embodiments are formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

Various component embodiments of the present disclosure may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of a gateway, proxy server, some or all of the components in accordance with embodiments of the present disclosure. The present disclosure may also be implemented as a device or device program (eg, a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the present disclosure may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

It should be noted that the above-described embodiments are illustrative of the present disclosure and are not intended to limit the scope of the disclosure, and those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" The present disclosure can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be the same Hardware items are embodied. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

Claims

A method for detecting a public WiFi phishing risk, comprising:

Obtaining information obtained by the user equipment UE detecting the wireless access point AP of the public wireless fidelity WiFi, where the obtained information includes a target service set identifier SSID of the AP and target media access control MAC information of the AP ;

Determining, according to the pre-stored MAC information reference library, whether the target MAC information is consistent with a secure MAC information corresponding to the target SSID recorded by the MAC information reference library, and the secure MAC information corresponding to the target SSID is one Or multiple;

When the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID recorded by the MAC information reference library, it is determined that the public WiFi has a phishing risk.
The method according to claim 1, wherein said target MAC information comprises a target MAC address, said secure MAC information comprises a secure MAC address, and said determining whether said target MAC information is recorded with said MAC information reference library A secure MAC information corresponding to the target SSID is consistent, including:

Determining whether the target MAC address is consistent with one of the secure MAC addresses corresponding to the target SSID recorded by the MAC information reference library;

Wherein, when the target MAC address is inconsistent with any one of the secure MAC addresses, it indicates that the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID of the MAC information reference record.
The method of claim 1, wherein the target MAC information comprises a target MAC manufacturer, the secure MAC information comprises a secure MAC producer, and determining whether the target MAC information is recorded with the MAC information reference library The same secure SS information corresponding to the target SSID is consistent, including:

Determining whether the target MAC manufacturer is consistent with one of the secure MAC producers corresponding to the target SSID recorded by the MAC information reference library;

Wherein, when the target MAC manufacturer is inconsistent with any one of the secure MAC producers, it indicates that the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID of the MAC information reference record.
The method of claim 2, wherein the target MAC information further comprises a target MAC producer, the secure MAC information further comprising a secure MAC producer, when the target MAC address is associated with any one of the secure MACs When the addresses are inconsistent, it is determined whether the target MAC information is consistent with a secure MAC information corresponding to the target SSID recorded by the MAC information reference database, and further includes:

Determining whether the target MAC manufacturer is consistent with one of the secure MAC producers corresponding to the target SSID recorded by the MAC information reference library;

Wherein, when the target MAC address is inconsistent with any one of the secure MAC addresses, and the target MAC manufacturer is also inconsistent with any one of the secure MAC manufacturers, the target MAC information and the MAC are indicated. Any one of the secure MAC information corresponding to the target SSID of the information reference record is inconsistent.
The method of claim 4, wherein the method further comprises:

When the target MAC address is inconsistent with any one of the secure MAC addresses, and the target MAC manufacturer is consistent with one of the secure MAC producers, the target MAC address is recorded as the location corresponding to the target SSID. The secure MAC address.
A device for detecting a public WiFi phishing risk, comprising:

And an obtaining module, configured to obtain information obtained by the user equipment UE detecting the wireless access point AP of the public wireless fidelity WiFi, where the obtained information includes a target service set identifier SSID of the AP and a target of the AP Media access control MAC information;

a determining module, configured to determine, according to the pre-stored MAC information reference library, whether the target MAC information is consistent with a secure MAC information corresponding to the target SSID recorded by the MAC information reference library, where the target SSID is The security MAC information is one or more;

And a determining module, configured to determine that the public WiFi has a phishing risk when the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID recorded by the MAC information reference library.
The apparatus according to claim 6, wherein the target MAC information includes a target MAC address, the secure MAC information includes a secure MAC address, and the determining module is configured to determine whether the target MAC address is related to the MAC address. One of the secure MAC addresses corresponding to the target SSID recorded by the information base library is consistent;

Wherein the target MAC address is inconsistent with any one of the secure MAC addresses At the time, it is indicated that the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID of the MAC information reference record.
The apparatus according to claim 6, wherein said target MAC information comprises a target MAC manufacturer, said secure MAC information comprises a secure MAC manufacturer, and said determining module is configured to determine whether said target MAC producer is One of the secure MAC producers corresponding to the target SSID recorded by the MAC information reference library is consistent;

Wherein, when the target MAC manufacturer is inconsistent with any one of the secure MAC producers, it indicates that the target MAC information is inconsistent with any one of the secure MAC information corresponding to the target SSID of the MAC information reference record.
The apparatus according to claim 7, wherein said target MAC information further comprises a target MAC producer, said secure MAC information further comprising a secure MAC producer, said target MAC address and any one of said secure MACs When the addresses are inconsistent, the determining module is further configured to determine whether the target MAC manufacturer is consistent with one of the secure MAC producers corresponding to the target SSID recorded by the MAC information reference library;

Wherein, when the target MAC address is inconsistent with any one of the secure MAC addresses, and the target MAC manufacturer is also inconsistent with any one of the secure MAC manufacturers, the target MAC information and the MAC are indicated. Any one of the secure MAC information corresponding to the target SSID of the information reference record is inconsistent.
The device of claim 9 wherein said device further comprises:

a recording module, configured to record the target MAC address as the target MAC address when the target MAC address is inconsistent with any one of the secure MAC addresses, and the target MAC manufacturer is consistent with one of the secure MAC manufacturers The secure MAC address corresponding to the target SSID.
A computer program comprising computer readable code causing the computing device to perform a public WiFi phishing risk according to any one of claims 1-5 when the computer readable code is run on a computing device Detection method.
A computer readable medium storing the computer program of claim 11.