Location method of wireless spoofing attack based on rss

Abstract

The invention discloses an RSS-based wireless spoofing attack positioning method, including: establishing a location fingerprint database corresponding to the WLAN environment; using beacons to monitor wireless data packets in the WLAN in real time, and then extracting and obtaining the RSS data stream of each node; using K ‑Central point algorithm, select multiple K values, and according to each K value, cluster the RSS data stream of each node in turn to obtain the corresponding clustering results, and finally obtain multiple clustering results for each node; for After evaluating the multiple clustering results obtained by each node, the optimal clustering result corresponding to each node is obtained; after sequentially obtaining the representative objects of multiple clusters in the optimal clustering result, combined with the location fingerprint database to calculate and obtain The location coordinates of the attacker, and output the positioning result. The invention can locate one or more attackers with high positioning accuracy and can be widely used in the field of wireless information security.

Description

technical field [0001] The invention relates to the field of wireless security research, in particular to an RSS-based wireless deception attack positioning method. Background technique [0002] Glossary: [0003] RSS: received signal strength; [0004] WLAN: Wireless Local Area Networks, wireless local area network; [0005] ISM frequency band: Industrial Scientific Medical Band, industrial, scientific and medical frequency band; [0006] ACL: access control list; [0007] AP: Access Point, access point, also called beacon in the present invention; [0008] RAP: Rogue Access Point; [0009] DoS: denial of service; [0010] MAC: Medium / Media Access Control, or MAC address, physical address, used to represent the identifier of each site on the Internet; [0011] SSID: Service Set Identifier, service set identifier, SSID technology can divide a wireless local area network into several sub-networks that require different authentication. Each sub-network requires independ...

AI Technical Summary

Problems solved by technology

However, most of the current RSS-based WLAN security detection methods can only locate a single attacker. When multiple attackers use the same identity to cooperate with each other to launch a spoofing attack, none of these methods can determine the physical location of the attacker.

3. RSS is a physical property related to wireless signals. Due to various wireless interference factors, such as synchronous interference, asynchronous interference and physical interference, RSS is easy to generate more noise. The current research method is difficult to deal with the existence of outliers Or the RSS data of large and small clusters, so that the attacker cannot be accurately located

Images