Pseudo AP detection method based on RSSI

Abstract

The invention discloses a pseudo AP detection method based on an RSSI, and belongs to the field of wireless network safety. The method comprises the steps: obtaining the RSSI sequences of all current APs; selecting the effective RSSI sequence from the RSSI sequences; selecting a reference AP, corresponding to a target AP, from all current Aps; generating an effective RSSI fingerprint library according to the obtained reference AP through combining with the effective RSSI sequence, thereby obtaining the similarity of the reference AP with the reference AP in the effective RSSI fingerprint library; carrying out positioning according to the similarity; obtaining the first fingerprint data of the target AP at a virtual positioning place, obtaining a fingerprint difference between the first fingerprint data and second fingerprint data through combining with the actually obtained second fingerprint data at the target AP, and obtaining a pseudo AP detection result according to the similarity and the section where the fingerprint difference is located. The method can shorten the detection time in the prior art, improves the timeliness of detection, does not need the connection with a suspicious AP in a detection process, and reduces the risks of network attack.

Description

technical field [0001] The invention belongs to the field of wireless network security, in particular to an RSSI-based false AP detection method. Background technique [0002] Wi-Fi SSID (ServiceSetIdentifier, service set identifier) ​​is easy to be forged, and attackers can easily deploy malicious fake APs that ordinary users cannot distinguish from legitimate APs (WirelessAccessPoint, wireless access point). Once the user connects to the fake AP, the attacker can completely control the user's online environment, further implement advanced attacks such as privacy sniffing and malicious data tampering, and even control the behavior of smart devices, such as opening or closing smart door locks. [0003] There are mainly two existing methods for detecting fake APs: detection based on hardware features and detection based on traffic features. The hardware feature detection method uses different network card chips and drivers to have different fingerprint features to establish ...

AI Technical Summary

Problems solved by technology

[0005] Establishing a hardware feature fingerprint library is costly, takes a long time to extract fingerprints, and has poor real-time performance; the traffic feature detection method can be bypassed by some highly concealed fake APs, and the above two methods require detection equipment and fake AP connections to detect, so it is easy Attacked by the attacker's network

Images