CN101835144A - Method and device for security detection of wireless network - Google Patents
Method and device for security detection of wireless networkDownload PDFInfo
- Publication number
- CN101835144A CN101835144ACN201010181872ACN201010181872ACN101835144ACN 101835144 ACN101835144 ACN 101835144ACN 201010181872 ACN201010181872 ACN 201010181872ACN 201010181872 ACN201010181872 ACN 201010181872ACN 101835144 ACN101835144 ACN 101835144A
- Authority
- CN
- China
- Prior art keywords
- wireless network
- analysis
- message
- response message
- security detection
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
Description
Technical field
The present invention relates to wireless communication technology field, relate in particular to a kind of method and apparatus that wireless network is carried out safety detection.
Background technology
WLAN (Wireless local area network, WLAN (wireless local area network)) is the product that computer network and wireless communication technology combine, WLAN utilizes RF (Radio Frequency, radio frequency) technology is carried out transfer of data, avoided of the constraint of cable network cable to the user, make the user can be at any time, access network everywhere, thereby can utilize Internet resources easily.
Along with WLAN (wireless local area network) use increasingly extensive, its safety problem also more and more is subjected to people's attention.For cable network, to specific destination, under the situation that physical link is destroyed, just might reveal usually by data by cable transmission for data.And in WLAN (wireless local area network), data are aloft to propagate, as long as in the scope that WAP (wireless access point) covers, terminal can receive wireless signal, and WAP (wireless access point) can not be directed to signal a specific receiving equipment.The publicity of transmission medium has brought WLAN easier to be under attack in this WLAN (wireless local area network), so the safety problem of WLAN (wireless local area network) seems particularly outstanding.
In order to guarantee secure communication, worked out corresponding safety standard in the WLAN (wireless local area network), but the safety standard of working out in the WLAN (wireless local area network) also can not guarantee the fail safe of WLAN (wireless local area network) fully, has multiple safety problem.
A kind of method that WLAN is carried out safety detection of the prior art is: utilize the catching of message, decoding and specific character string filtering function to find WAP (wireless access point) and client among the WLAN, message to described WAP (wireless access point) and client carries out multianalysis, thereby detect and orient the malice access point, reach the purpose of the fail safe that detects WLAN.
In realizing process of the present invention, the inventor finds of the prior artly WLAN to be carried out the method for safety detection there are the following problems at least: although can detect and orient malice access point among the WLAN, but this scheme is primarily aimed at WLAN carries out the passive security detection, can not carry out safety detection to WLAN all sidedly.
Summary of the invention
Embodiments of the invention provide a kind of wireless network have been carried out the method and apparatus of safety detection, to realize that wireless network is carried out safety detection initiatively.
A kind of wireless network is carried out the device of safety detection, comprising:
Management control module is used to be provided for the active attack script of safety detection, and the management control command of carrying described active attack script is handed down to analysis and processing module;
Analysis and processing module is used for being provided with according to described management control command the value of each special domain of test packet, generates corresponding test packet, and described test packet is sent to the packet sending and receiving processing module;
The packet sending and receiving processing module is used for described test packet is sent to wireless network, and the test terminal in the reception wireless network generates response message after described test packet is handled, and described response message is sent to analysis and processing module;
Described analysis and processing module also is used for the statistics and the parsing of described response message, obtains the statistics and the analysis result of response message, and described statistics and analysis result are sent to management control module;
Described management control module also is used for statistics and analysis result according to described message, and described active attack script carries out analysis-by-synthesis, obtains the safety detection result of described wireless network.
A kind of wireless network is carried out the method for safety detection, comprising:
Be provided for the active attack script of safety detection, generate test packet, described test packet is sent in the wireless network according to described active attack script;
The response message that the back sends is handled to described test packet in the test terminal that receives in the wireless network, and described response message is added up and resolved, and obtains the statistics and the analysis result of response message;
According to described statistics and analysis result, and described active attack script carries out analysis-by-synthesis, obtains the safety detection result of described wireless network.
The technical scheme that is provided by the embodiment of the invention described above as can be seen, the embodiment of the invention utilizes test packet that wireless network is carried out active attack, the security breaches that may exist with the detection wireless network, comprehensively and effectively to wireless network safety analysis, and then provide comprehensive analysis evaluation and test data, the fail safe that can improve wireless network largely for the safely instruction of wireless network.
Description of drawings
In order to be illustrated more clearly in the technical scheme of the embodiment of the invention, the accompanying drawing of required use is done to introduce simply in will describing embodiment below, apparently, accompanying drawing in describing below only is some embodiments of the present invention, for those of ordinary skills, under the prerequisite of not paying creative work, can also obtain other accompanying drawing according to these accompanying drawings.
A kind of structure chart that wireless network is carried out the device of safety detection initiatively that Fig. 1 provides for the embodiment of the invention one;
A kind of process chart that wireless network is carried out the method for safety detection initiatively that Fig. 2 provides for the embodiment of the invention two.
Embodiment
In the embodiment of the invention, be provided for the active attack script of safety detection, generate test packet, described test packet is sent in the wireless network according to described active attack script.The response message that the back sends is handled to described test packet in the test terminal that receives in the wireless network, described response message is added up and resolved, obtain the statistics and the analysis result of response message, according to described statistics and analysis result, and described active attack script carries out analysis-by-synthesis, obtains the safety detection result of described wireless network.
For ease of understanding, be that example is further explained explanation below in conjunction with accompanying drawing with several specific embodiments, and each embodiment does not constitute the qualification to the embodiment of the invention to the embodiment of the invention.
Embodiment one
This embodiment provides a kind of wireless network has been carried out the device of safety detection initiatively, and this device can be the main controlled node in the wireless network.This device generates test packet by the active attack script that sets in advance, and utilizes test packet that wireless network is carried out active attack, obtains the safety detection result of wireless network.
The structure of the above-mentioned device that wireless network is carried out safety detection initiatively comprises following module: management control module 11, rule parsing module 12, analysis and processing module 13 and packet sending and receiving processing module 14 as shown in Figure 1.
Management control module 11 is used to be provided for the active attack script of safety detection, and the management control command of carrying described active attack script is handed down to the rule parsing module, and analysis and processing module is carried out the control corresponding bookkeeping.The statistics and the analysis result of the response message that sends according to analysis and processing module, and the test result of active attack carries out analysis-by-synthesis, obtains the safety detection result of described wireless network.
Rule parsing module 12, be used for the management control command that the receiving management control module sends, the call instruction resolver is resolved described management control command, and the mapping ruler according to analysis result generation message sends to analysis and processing module and management control module with this mapping ruler.
Analysis and processing module 13 is used for being provided with according to described mapping ruler the value of each special domain of test packet, constructs corresponding test packet, and described test packet is sent to the packet sending and receiving processing module.The response message that described packet sending and receiving processing module is sent carries out preliminary treatment, statistics and parsing, obtains the statistics and the analysis result of response message, and described statistics and analysis result are sent to management control module;
Packet sending and receiving processing module 14 is used for described test packet is sent to wireless network, and the response message that the back sends is handled to described test packet in the test terminal that receives in the wireless network, and described response message is sent to analysis and processing module.
Described management control module 11 specifically comprises:
The management control command issues module 111, be used for the active attack script that topological structure and network state according to wireless network are provided for safety detection, the management control command of carrying described active attack script is handed down to described rule parsing module and analysis and processing module;
Safety detection result acquisition module 112 is used for statistics and analysis result according to the message of described analysis and processing module transmission, and described active attack script and mapping ruler, carries out analysis-by-synthesis, evaluation, obtains the safety detection result of wireless network.
Described analysis and processing module 13 specifically comprises:
Test packet generation module 131 is used for being provided with according to the mapping ruler that described rule parsing module sends the value of each special domain of test packet, constructs corresponding test packet, and described test packet is sent to the packet sending and receiving processing module;
Response message processing module 132, be used for the response message that receives is filtered and buffer memory, response message to described buffer memory is added up according to speed, protocol type, type of message, obtain the statistics of response message, according to described mapping ruler the response message of buffer memory is resolved, read the value of each special domain in the response message, obtain the analysis result of response message, the statistics and the analysis result of described response message sent to management control module.
Wireless network analysis module 133, be used for the message of the wireless network that receives is analyzed, set up the topological structure and the network state of wireless network according to analysis result, the topological structure and the network state of this wireless network sent to described management control module.
Embodiment two
Shown in Figure 1 wireless network is carried out the device of safety detection initiatively based on above-mentioned, the handling process of a kind of method of wireless network being carried out safety detection initiatively that this embodiment provides comprises following treatment step as shown in Figure 2:
The management control command thatstep 21, management control module will carry active attack script is handed down to the rule parsing module.
After the above-mentioned device that wireless network is carried out safety detection initiatively starts, the packet sending and receiving processing module in the said apparatus will be caught the message in the interior wireless network of certain limit, and the message of catching is sent to analysis and processing module.Analysis and processing module is analyzed the message that receives, set up the topological structure and the network state of wireless network according to analysis result, the topological structure of this wireless network and network state are sent to management control module in the device, and management control module carries out simple internet security assessment according to the topological structure and the network state of the wireless network that receives to wireless network.
Then, above-mentioned management control module is according to the topological structure and the network state of existing wireless network, and the internet security assessment result is provided for the active attack script of safety detection, and the management control command of carrying above-mentioned active attack script is handed down to rule parsing module in the said apparatus.
Above-mentioned rule parsing module invokes command analysis device is resolved above-mentioned management control command, and the mapping ruler according to the generation of the active attack script in above-mentioned management control command message sends to analysis and processing module and management control module with this mapping ruler.
The mapping ruler that analysis and processing module sends according to above-mentioned rule parsing module is provided with the value of each special domain of test packet, constructs corresponding test packet.Then, by the packet sending and receiving processing module in the said apparatus above-mentioned test packet is sent in the wireless network.
The test packet that packet sending and receiving processing module in the said apparatus sends is received by the test terminal in the wireless network, and above-mentioned test terminal sends to response message in the wireless network again after test packet is handled accordingly.
Packet sending and receiving processing module in the said apparatus is caught the message in the interior wireless network of certain limit once more, and the response message that the above-mentioned test terminal that captures is sent sends to analysis and processing module.
Above-mentioned analysis and processing module is carried out preliminary treatment to the response message that receives, and this preliminary treatment mainly comprises: according to the filtering rule that sets in advance the response message that receives is filtered, the response message that obtains after filtering is carried out buffer memory.
Above-mentioned analysis and processing module is added up according to different types such as speed, protocol type, type of messages the response message of above-mentioned buffer memory, obtains the statistics of response message.Above-mentioned analysis and processing module is also resolved the response message of buffer memory according to above-mentioned mapping ruler, reads the value of each special domain in the response message, obtains the analysis result of response message.Above-mentioned analysis and processing module sends to management control module with the statistics and the analysis result of above-mentioned response message.
Management control module is according to the statistics and the analysis result of the message of above-mentioned analysis and processing module transmission, and the test result of above-mentioned active attack script and mapping ruler, active attack, carry out analysis-by-synthesis, evaluation, obtain the safety detection result of wireless network.
Testing process among the above-mentioned steps 21-24 can be carried out repeatedly, obtains a plurality of safety detection result of above-mentioned wireless network.At last, a plurality of safety detection result of management control module analysis-by-synthesis wireless network are obtained the final safety detection result of wireless network.
The described method and apparatus that wireless network is carried out safety detection initiatively of the invention described above embodiment goes for wireless networks such as WLAN.
One of ordinary skill in the art will appreciate that all or part of flow process that realizes in the foregoing description method, be to instruct relevant hardware to finish by computer program, described program can be stored in the computer read/write memory medium, this program can comprise the flow process as the embodiment of above-mentioned each side method when carrying out.Wherein, described storage medium can be magnetic disc, CD, read-only storage memory body (Read-Only Memory, ROM) or at random store memory body (Random AccessMemory, RAM) etc.
In sum, the embodiment of the invention has proposed a kind of method and apparatus that more fully wireless networks such as WLAN is carried out safety detection initiatively at the deficiency of existing wireless LAN safety analytic product.The embodiment of the invention is carried out active attack by utilizing test packet to wireless network, the security breaches that may exist with the detection wireless network, can be fully and effectively to wireless network safety analysis, and then provide comprehensive analysis evaluation and test data, the fail safe that can improve wireless network largely for the safely instruction of wireless network.
The embodiment of the invention can adapt to multiple Radio Link, supports active safety analysis and passive security analytic function simultaneously, and supports the Wi-Fi protocol suite, is with good expansibility, and can implement the analysis strategy of user's design.
The above; only for the preferable embodiment of the present invention, but protection scope of the present invention is not limited thereto, and anyly is familiar with those skilled in the art in the technical scope that the present invention discloses; the variation that can expect easily or replacement all should be encompassed within protection scope of the present invention.Therefore, protection scope of the present invention should be as the criterion with the protection range of claim.
Claims (10)
Translated fromChinesePriority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201010181872ACN101835144A (en) | 2010-05-25 | 2010-05-25 | Method and device for security detection of wireless network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201010181872ACN101835144A (en) | 2010-05-25 | 2010-05-25 | Method and device for security detection of wireless network |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN101835144Atrue CN101835144A (en) | 2010-09-15 |
Family
ID=42719034
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201010181872APendingCN101835144A (en) | 2010-05-25 | 2010-05-25 | Method and device for security detection of wireless network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101835144A (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104219218A (en)* | 2013-06-04 | 2014-12-17 | 杭州华三通信技术有限公司 | Active safety defense method and active safety defense device |
| CN105262777A (en)* | 2015-11-13 | 2016-01-20 | 北京奇虎科技有限公司 | Local area network (LAN)-based security detection method and device |
| CN107888598A (en)* | 2017-11-17 | 2018-04-06 | 中广核工程有限公司 | A kind of nuclear power station secondary electrical system Information Security Risk evaluating system and method |
| CN109873704A (en)* | 2017-12-01 | 2019-06-11 | 中国信息通信研究院 | A network security risk assessment system and method based on runtime state analysis |
| CN113115356A (en)* | 2020-01-13 | 2021-07-13 | 广州致远电子有限公司 | Wireless signal detection system, wireless signal detection method and wireless signal detection equipment |
| CN116192703A (en)* | 2022-11-16 | 2023-05-30 | 北京光电智云通信技术有限公司 | Network port detection system based on record authorization |
- 2010
- 2010-05-25CNCN201010181872Apatent/CN101835144A/enactivePending
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104219218A (en)* | 2013-06-04 | 2014-12-17 | 杭州华三通信技术有限公司 | Active safety defense method and active safety defense device |
| CN104219218B (en)* | 2013-06-04 | 2018-05-08 | 新华三技术有限公司 | A kind of method and device of active safety defence |
| CN105262777A (en)* | 2015-11-13 | 2016-01-20 | 北京奇虎科技有限公司 | Local area network (LAN)-based security detection method and device |
| WO2017080424A1 (en)* | 2015-11-13 | 2017-05-18 | 北京奇虎科技有限公司 | Security detection method and apparatus based on local area network |
| CN107888598A (en)* | 2017-11-17 | 2018-04-06 | 中广核工程有限公司 | A kind of nuclear power station secondary electrical system Information Security Risk evaluating system and method |
| CN107888598B (en)* | 2017-11-17 | 2020-08-11 | 中广核工程有限公司 | Nuclear power station electrical secondary system information safety risk evaluation system and method |
| CN109873704A (en)* | 2017-12-01 | 2019-06-11 | 中国信息通信研究院 | A network security risk assessment system and method based on runtime state analysis |
| CN113115356A (en)* | 2020-01-13 | 2021-07-13 | 广州致远电子有限公司 | Wireless signal detection system, wireless signal detection method and wireless signal detection equipment |
| CN116192703A (en)* | 2022-11-16 | 2023-05-30 | 北京光电智云通信技术有限公司 | Network port detection system based on record authorization |
| CN116192703B (en)* | 2022-11-16 | 2025-04-01 | 北京光电智云通信技术有限公司 | A network port detection system based on filing authorization |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105227383B (en) | A kind of device of network topology investigation | |
| CN110209583B (en) | Security testing methods, devices, systems, equipment and storage media | |
| CN102045214B (en) | Botnet detection method, device and system | |
| CN101835144A (en) | Method and device for security detection of wireless network | |
| CN112804123B (en) | A kind of network protocol identification method and system for dispatching data network | |
| CN113489619B (en) | A network topology inference method and device based on time series analysis | |
| CN102035793B (en) | Botnet detecting method, device and network security protective equipment | |
| Lu et al. | Research on WiFi penetration testing with Kali Linux | |
| CN103684912B (en) | Sensor network safety testing method and system | |
| CN114448830B (en) | Equipment detection system and method | |
| CN109063486B (en) | A security penetration testing method and system based on PLC device fingerprint identification | |
| CN105024877A (en) | A Hadoop Malicious Node Detection System Based on Network Behavior Analysis | |
| CN101931982A (en) | Network failure positioning method and device | |
| CN102970771A (en) | Signal detection and acquisition method and system based on wireless sensor network | |
| CN101924754A (en) | A malicious code control terminal active discovery method and device | |
| CN101488890A (en) | Method and system for network attack test | |
| CN110225064A (en) | Monitor method, apparatus, equipment and the storage medium of Botnet attack | |
| CN102420765A (en) | Method and device for determining physical link between switchboard and terminal | |
| Kumar et al. | Light weighted CNN model to detect DDoS attack over distributed scenario | |
| CN101902759A (en) | Method and device for security analysis of wireless network based on protocol test | |
| CN118300834A (en) | Attack flow generation method and device based on network target range and related equipment | |
| CN114363059B (en) | Attack identification method and device and related equipment | |
| Gentile et al. | Safeguarding sensitive data in the era of IoT: a study on security protocols for distributed measurement systems | |
| CN103856373B (en) | Web system robustness testing method based on HTTP mutation | |
| CN102624587A (en) | A detection system and method for implementation defects of IEC60870-5-101/104 communication protocol |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C02 | Deemed withdrawal of patent application after publication (patent law 2001) | ||
| WD01 | Invention patent application deemed withdrawn after publication | Application publication date:20100915 |