CN106912039B - Method and device for network configuration detection and repair of wireless network - Google Patents

Abstract

The application discloses a method and a device for detecting and repairing network configuration of a wireless network, wherein the method comprises the following steps: the method comprises the steps that a cloud detection server receives a detection request which is sent by a client and carries network configuration information obtained when the client is connected with a wireless network; the network configuration information at least comprises a malicious Uniform Resource Locator (URL) preset by the wireless network; the cloud detection server determines the network security level of the network configuration information according to a preset security detection rule; and the cloud detection server returns the network security level to the client for the client to repair the network configuration information with the security level being the network security level to be repaired. By the aid of the method and the device, safety of the wireless network can be improved.

Description

Method and device for network configuration detection and repair of wireless network

technical field

The present application relates to the technical field of network security, and in particular, to a method and device for detecting and repairing a network configuration of a wireless network.

Background technique

With the continuous popularization of mobile terminals (such as portable computers, mobile phones, and Pads), more and more users surf the Internet through wifi (Wireless Fidelity, wireless fidelity).

There are more and more places that provide free wifi in public places such as shopping malls, hotels, and restaurants. In general public places, a router is used to provide a public wifi network. This type of wireless network usually does not set a connection password. After the mobile terminal searches for the wireless network, it can directly access and use the wireless network. However, some criminals often use public wireless networks to tamper with router settings through hacking software, and can parse the URLs that users normally visit to phishing websites to steal users' private information and data (such as bank card account passwords, personal privacy Wait).

To sum up, there is a problem that the wireless network is insecure in the prior art.

SUMMARY OF THE INVENTION

The purpose of the embodiments of the present application is to provide a method and device for detecting and repairing a network configuration of a wireless network, so as to solve the problem that the wireless network is insecure in the prior art.

In order to solve the above technical problems, the method and device for detecting and repairing the network configuration of a wireless network provided by the embodiments of the present application are implemented as follows:

A method for detecting and repairing a network configuration of a wireless network, comprising:

The cloud detection server receives a detection request sent by the client carrying the network configuration information obtained when the client connects to a wireless network; wherein, the network configuration information at least includes a malicious Uniform Resource Locator URL preset by the wireless network;

The cloud detection server determines the network security level of the network configuration information according to a preset security detection rule;

The cloud detection server returns the network security level to the client for the client to perform a repair action on the network configuration information whose security level is the network security level to be repaired.

Preferably, the security detection rules include: if the URL conforms to the first URL security rule, the network security level is dangerous; if the URL conforms to the second URL security rule, the network security level is safe; if the URL conforms to the first URL security rule, the network security level is safe; Three URL security rules, the network security level is warning.

Preferably, the network configuration information further includes the Domain Name System DNS of the WAN interface of the WAN;

The cloud detection server determines the network security level of the network configuration information according to the preset security detection rules, which specifically includes:

The cloud detection server determines the network security level of the network configuration information according to the preset security detection rules; wherein, the security detection rules include: if the DNS conforms to the first DNS security rule, the network security level is dangerous; for example, the DNS If the second DNS security rule is complied with, the network security level is safe; if the DNS complies with the third DNS security rule, the network security level is warning.

Preferably, the network configuration information further includes the DNS of the Dynamic Host Configuration Protocol DHCP;

The cloud detection server determines the network security level of the network configuration information according to the preset security detection rules, which specifically includes:

The cloud detection server determines the network security level of the network configuration information according to the preset security detection rules; wherein, the security detection rules include: if the DNS conforms to the first DNS security rule, the network security level is dangerous; for example, the DNS If the second DNS security rule is complied with, the network security level is safe; if the DNS complies with the third DNS security rule, the network security level is warning.

Preferably, before the cloud detection server returns the network security level to the client, the method further includes:

Determine whether the network connection between the cloud detection server and the client is normal;

If the network connection between the cloud detection server and the client is abnormal, the cloud detection server stores the network security level, and returns the network security level when the network connection between the cloud detection server and the client is normal. to the client.

A network configuration detection and repair device for a wireless network, comprising:

a receiving unit, configured to receive a detection request sent by a client carrying network configuration information obtained when the client connects to a wireless network; wherein the network configuration information at least includes a malicious Uniform Resource Locator URL preset by the wireless network;

a detection unit, configured to determine the network security level of the network configuration information according to a preset security detection rule;

The returning unit is configured to return the network security level to the client, so that the client can perform a repair action on the network configuration information whose security level is the network security level to be repaired.

Preferably, the security detection rules include: if the URL conforms to the first URL security rule, the network security level is dangerous; if the URL conforms to the second URL security rule, the network security level is safe; if the URL conforms to the first URL security rule, the network security level is safe; Three URL security rules, the network security level is warning.

Preferably, the network configuration information further includes the Domain Name System DNS of the WAN interface of the WAN;

The detection unit is specifically used for:

The network security level of the network configuration information is determined according to a preset security detection rule; wherein, the security detection rule includes: if the DNS complies with the first DNS security rule, the network security level is dangerous; if the DNS complies with the second DNS security rule, the network security level is dangerous; DNS security rules, the network security level is safe; if the DNS conforms to the third DNS security rule, the network security level is warning.

Preferably, the network configuration information further includes the Domain Name System DNS of the WAN interface of the WAN;

The detection unit is specifically used for:

The network security level of the network configuration information is determined according to a preset security detection rule; wherein, the security detection rule includes: if the DNS complies with the first DNS security rule, the network security level is dangerous; if the DNS complies with the second DNS security rule, the network security level is dangerous; DNS security rules, the network security level is safe; if the DNS conforms to the third DNS security rule, the network security level is warning.

Preferably, before returning to the unit, it also includes:

a judging unit for judging whether the network connection between the cloud detection server and the client is normal;

The returning unit is specifically used for:

When the network connection between the cloud detection server and the client is abnormal, the cloud detection server stores the network security level; and when the network connection between the cloud detection server and the client is normal, the network security level is stored in the cloud detection server. Return to the client, for the client to perform a repair action on the network configuration information whose security level is the network security level to be repaired.

It can be seen from the technical solutions provided by the above embodiments of the present application that the cloud detection server receives the detection request sent by the client and carries the network configuration information obtained when the client connects to the wireless network; wherein, the network configuration information at least includes the wireless network. A preset malicious Uniform Resource Locator URL; the security level of the network configuration information is determined by a preset security detection rule, so that the client can perform a repair action on the network configuration information whose security level is the network security level to be repaired . Through the above process in this embodiment of the present application, the cloud detection server may detect the network configuration information carried in the detection request sent by the client, and the cloud detection server may detect the network security level that needs to be repaired (including the preset wireless network security level). The URL is tampered with, etc.) and returned to the client, and finally the client determines whether the network configuration information needs to be repaired accordingly, so as to ensure the security of the wireless network.

Description of drawings

The drawings described herein are used to provide further understanding of the present application and constitute a part of the present application. The schematic embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation of the present application. In the attached image:

FIG. 1 provides a system architecture diagram for realizing network configuration detection and repair of a wireless network in an embodiment of the present application;

2 is a flowchart of a method for detecting and repairing a network configuration of a wireless network according to an embodiment of the present application;

3 is a flowchart of a method for detecting and repairing a network configuration of a wireless network according to an embodiment of the present application;

4 is a flowchart of a method for detecting and repairing a network configuration of a wireless network according to an embodiment of the present application;

5 is a flowchart of a method for detecting and repairing a network configuration of a wireless network according to an embodiment of the present application;

6 is a block diagram of an apparatus for detecting and repairing a network configuration of a wireless network according to an embodiment of the present application;

7 is a block diagram of an apparatus for detecting and repairing a network configuration of a wireless network according to an embodiment of the present application;

FIG. 8 is a block diagram of an apparatus for detecting and repairing a network configuration of a wireless network according to an embodiment of the present application.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be clearly and completely described below with reference to the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

FIG. 1 provides a system architecture diagram for implementing network configuration detection and repair of a wireless network in an embodiment of the present application. In this embodiment of the present application, the system architecture includes a client 10 , a cloud detection server 30 communicating with the client 10 , a router 20 corresponding to the wireless network used by the client 10 , and a database 40 corresponding to the cloud detection server 30 . The router may be, for example, a wireless network router, an intelligent flow control router, a dynamic speed limit router, a virtual router, or a broadband router. The above-mentioned client may be a computer or a mobile phone, and the above-mentioned database at least stores corresponding security detection rules for detecting the network security level of the wireless network.

FIG. 2 is a flowchart of a method for detecting and repairing a network configuration of a wireless network according to an embodiment of the present application. In this embodiment, the above method includes the following steps:

S101: The client obtains network configuration information of a wireless network connected to the client; wherein the network configuration information at least includes a malicious Uniform Resource Locator URL preset by the wireless network.

In this embodiment, an application (Application, APP) for detecting the network configuration information of the wireless network is installed on the client, the network configuration information of the wireless network can be set by the client, and the network configuration information at least includes the wireless network Malicious Uniform Resource Locator (URL) preset by the network. Specifically, when the user configures the wireless network used through the client, he can choose to set malicious URLs, so that these malicious URLs can be filtered in the process of surfing the Internet in the future to avoid the malicious URLs in the The included malicious script poses a security risk to the client. The above malicious URLs can be obtained by obtaining log data, and analyzing the log data through the malicious website automatic analysis system to obtain malicious URLs containing malicious scripts, and put the obtained malicious URLs into the malicious URL database. In practical applications, different wireless networks can set different malicious URLs, and these malicious URLs can be selected from the malicious URL database.

Of course, in the embodiment of the present application, the above-mentioned network configuration information is not limited to the above-mentioned malicious URL, and may also include the Domain Name System DNS of the WAN interface of the WAN and the DNS of the Dynamic Host Configuration Protocol DHCP. The WAN (Wide Area Network, wide area network) is the port through which the network device connects to the external network, and criminals often tamper with the DNS of the WAN interface of the network connection device into malicious DNS. Malicious DNS steals users' private information and data (such as bank card account passwords, personal privacy, etc.) by parsing normal URLs to phishing websites or hosts controlled by criminals. The DHCP (Dynamic Host Configuration Protocol, Dynamic Host Configuration Protocol) is used to automatically assign IP (Internet Protocol, protocol for interconnection between networks) addresses to networks or network service providers. If the client connects to a network connection device with DHCP function and uses the automatic IP address acquisition, the DNS of the network connection device DHCP will be synchronized to the local client, so once the DNS of the network connection device DHCP is tampered with malicious DNS If this happens, all clients connecting to this network-connected device will be at great risk.

Specifically, obtaining the network configuration of the wireless network accessed by the client terminal may include the following steps:

A1: Obtain the IP address of the DHCP-capable network-connected device from the registry.

For example, the IP address of a DHCP-capable network-connected device can be read from the registry at HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{GUID}\DhcpServer.

A2: Establish a network connection with the network connection device with DHCP function through the IP address, and obtain the model of the network connection device with DHCP function through the HTTP header data in the data packet returned by the connection.

For example, by connecting to the IP address of the DHCP-capable network connection device (for example: http://RouterIP), the connection can be made with the IP address of the DHCP-capable network connection device, and a return packet is received from the address, The returned data packet includes HTTP header data, and the HTTP header data includes the model of the network connection device with the DHCP function.

A3: According to the IP address of the network connection device with DHCP function and the model of the network connection device with DHCP function, visit the DHCP configuration page of the network connection device with DHCP function, and obtain the DHCP function of the network connection device from this page. DNS.

According to the obtained IP address of the DHCP-capable network connection device and the model of the DHCP-capable network connection device, use the management user name and password of the network connection device to access the DHCP configuration page of the DHCP-capable network connection device.

It should be noted that, in practical applications, other appropriate manners for obtaining the DNS of the DHCP of the wireless network are also applicable to the embodiments of the present application.

In another embodiment of the present application, the network configuration may further include: management password, remote WEB management enable status, isolation area host service enable status, and wireless network security configuration parameters.

In actual use, in addition to the tampering of the DNS of the WAN interface and the DNS of the DHCP, which will cause great security risks, the following factors may also affect the security of the wireless network:

(1) Management password, where the management password is a password for logging in to the network link device. If the management password is a weak password, it is easy for criminals to crack the password, thereby tampering with the DNS of the network connection device. The weak password may include the default password provided by the network connection device manufacturer for the management password (for example, the default username and password of TP-link are both admin), or a weak password that is easily cracked (for example, 123456, 000000, etc.).

(2) The remote WEB management open state, generally, the remote WEB management open state is divided into an open state and a closed state. If the remote WEB management is enabled on the network connection device, the network connection device can be accessed on the public network, and criminals can easily tamper with the DNS of the network connection device through the remote IP address.

(3) DMZ (demilitarized zone, DMZ) host service enabled state, usually the host service enabled state of the demilitarized zone is divided into an on state and an off state. If the isolation zone host service is disabled on the network connection device, the device connected to the intranet will not be sent on the public network; however, if the isolation zone host service is enabled on the network connection device, that is, after setting a device in the intranet as the DMZ host, the Devices on the public network can also be connected to devices on the internal network, so that the devices that enable external services are used as springboards, and devices that attack the internal network include tampering with the DNS of the network-connected devices.

(4) Wireless network security configuration parameters. The wireless network security configuration parameters in this embodiment may include a wireless network open state and a wireless network password. If the wireless network connection device has turned on the wireless network, but no password is set, or an insecure password authentication method is used, for example, the password authentication method is WEP encryption (Wired Equivalent Privacy), then the wireless network is more likely to be illegal. Molecular invasion.

Therefore, in order to better improve the security of the wireless network, in the network configuration for obtaining the wireless network, the network configuration may include, in addition to the DNS of WAN and/or DHCP, management password, remote WEB management status, isolation Zone host service status, wireless network security configuration parameters.

S102: The client sends a detection request carrying the foregoing network configuration information to the cloud detection server.

S103: The client receives the network security level corresponding to the detection request returned by the cloud detection server; wherein, the network security level is determined by the cloud detection server according to a preset security detection rule.

In this embodiment of the present application, the foregoing step S103 specifically includes the following steps:

The client receives the network security level determined according to the security detection rules preset on the cloud detection server and returned by the cloud detection server; wherein, the security detection rules include: such as URL and a URL corresponding to the wireless network pre-stored on the cloud detection server If not, the network security level is dangerous.

In practical applications, there is a hidden danger that other devices on the network side maliciously tamper with the network configuration information of the wireless network, and the tampering action includes tampering with a malicious URL preset by the wireless network. For example, delete the original malicious URL or add a non-malicious URL. Therefore, the above-mentioned security detection rule may be, for example: if the preset malicious URL is found to be inconsistent with the currently acquired malicious URL of the wireless network, the network security level of the wireless network is determined as dangerous. Of course, in other embodiments of the present application, the above-mentioned network security level may be determined according to the number of malicious URLs that are actually tampered with. For example, if the number of tampered with 1-10, the above-mentioned network security level is determined to be a warning; the number of tampered with is 10-50, determine the above network security level as dangerous; and so on.

In this embodiment of the present application, the foregoing step S103 may further specifically include the following steps:

The client receives the network security level determined according to the security detection rule preset on the cloud detection server and returned by the cloud detection server; wherein, the security detection rule includes: if the DNS conforms to the first DNS security rule, the network security level is Dangerous; if the DNS conforms to the second DNS security rule, the network security level is safe; if the DNS conforms to the third DNS security rule, the network security level is warning.

In this embodiment, the first DNS security rule may be located in a blacklist, and the blacklist records a malicious DNS list; the second DNS security rule may be located in a whitelist, and the whitelist records security DNS list; the third DNS security rule may be neither in the blacklist nor in the whitelist.

The blacklist and whitelist can be downloaded together with the download of the security detection rule and saved locally.

Generally, the method of generating the blacklist in the cloud detection server is as follows:

B1: Obtain a set of DNS correct resolution results of known domain names, and the set of DNS correct resolution results is obtained by parsing the known domain names by a set of domain name resolution servers.

In a specific implementation, the servers in a group of domain name resolution servers are all servers that have passed security authentication, and multiple domain name resolution servers with telecom operator qualifications can be selected. Known domain names can be selected from domain names with a large number of Internet users, such as online shopping website domain names, game website domain names, social networking website domain names, and so on.

B2: Obtain the DNS resolution result of the known domain name to be detected, and the DNS resolution result to be detected is the result of the target DNS resolving the known domain name.

B3: Check whether the DNS resolution result to be detected belongs to the set of correct DNS resolution results; if not, mark the target DNS as suspicious DNS.

Checking whether the DNS resolution result to be detected belongs to the set of correct DNS resolution results includes at least any one of the following methods: checking whether the IP address in the DNS resolution result to be detected belongs to the IP address list in the set of correct DNS resolution results; checking the DNS to be detected Check whether the alias record in the resolution result belongs to the list of alias records in the set of correct DNS resolution results; check whether the mail exchange record in the DNS resolution result to be detected belongs to the list of mail exchange records in the set of correct DNS resolution result. The above methods are respectively obtained based on the IP address (A record) corresponding to the domain name, the alias record (cname record) and the mail exchange record (Mail Exchanger, MX record) corresponding to the domain name in the DNS resolution result. The above three methods can be flexibly configured according to the actual situation. For example, only one of the IP addresses can be selected, or two or all three of the three methods can be comprehensively selected to query at the same time.

B4: Obtain the first page and the second page respectively, wherein the first page is the page corresponding to the correct DNS resolution result, and the second page is the page corresponding to the DNS resolution result to be detected.

B5: Calculate the page similarity between the first page and the second page.

In a specific implementation, there are multiple ways to calculate the page similarity. One way is to use a vector space model algorithm to calculate the page content similarity between the first page and the second page.

B6: When the similarity is less than the preset value, determine that the suspicious DNS is a malicious DNS.

When the similarity of page content is less than the preset value, it proves that the page corresponding to the suspicious DNS resolution result is not the page corresponding to the original domain name correctly, the suspicious DNS has tampered with the resolution target, and the valid DNS is determined as malicious DNS.

B7: Record the malicious DNS into a blacklist.

Generally, the method of generating the whitelist in the cloud detection server is as follows:

C1: Determining multiple domain name resolution servers with telecom operator qualifications (such as DNS resolution servers established by China Telecom Unicom in various places), domestic and international well-known domain name resolution servers (such as servers of Google, Hong Kong Hutchison Global Telecom), etc. as Secure DNS.

C2: Record secure DNS to the whitelist.

For example, the client obtains the DNS of WAN as (184.105.175.69, 66.102.253.29), and the DNS of DHCP as (184.105.175.69, 66.102.253.29); assuming that the blacklist of DNS of WAN contains (184.105.175.69, 66.102) .253.29), the DNS blacklist of DHCP contains (184.105.175.69, 66.102.253.29); after step S120, the obtained security level is shown in the following table:

S104: The client determines whether the network security level is the network security level to be repaired, and if so, performs a corresponding repair action on the network configuration information of the wireless network.

In an embodiment of the present application, if the above-mentioned network configuration information includes a malicious URL, the above-mentioned step S104 may specifically include the following steps:

The client determines whether the network security level is dangerous; if so, repairs the network configuration information. That is to say, the above network configuration information will be repaired only when the network security level is judged to be dangerous. Generally, the configuration information of each detected wireless network is pre-stored on the cloud detection server (preset by the user). If it is maliciously tampered with and needs to be repaired, you can obtain the configuration information of the wireless network before malicious tampering on the cloud detection server, and then restore the network configuration information of the wireless network accordingly. That's it. Of course, if it is determined that the network security level of the configuration information of the wireless network is safe, it does not need to be repaired.

In addition, in other embodiments of the present application, if the above-mentioned network configuration information includes the domain name system DNS of the WAN interface of the wide area network and the DNS of the dynamic host configuration protocol DHCP; then the above-mentioned step S104 may specifically include the following steps:

The client determines whether the network security level is dangerous or warning, and if so, repairs the network configuration information.

Based on the methods provided by the above embodiments, the present application can detect the network security level that needs to be repaired (including tampering with the preset URL of the wireless network, etc.) through the cloud detection server according to the network configuration information of the wireless network, and return it to the client Finally, the client determines whether the network configuration information needs to be repaired accordingly, so as to ensure the security of the wireless network.

FIG. 3 is a flowchart of a method for detecting and repairing a network configuration of a wireless network according to an embodiment of the present application. In this embodiment, the method includes the following steps:

S201: The client obtains network configuration information of a wireless network connected to the client; wherein, the network configuration information at least includes a malicious Uniform Resource Locator URL preset by the wireless network.

For this step, reference may be made to the specific content of the foregoing step S101, which will not be repeated herein.

S202: Determine whether the network connection between the client and the cloud detection server is normal.

In the actual application process, if the current client cannot communicate with the cloud detection server through the Internet, the cloud detection server cannot send the detection request to the cloud detection server, so that the cloud detection server can determine the network security level according to the detection request. In order to solve this problem. In order to enable the client to perform wireless network security detection even when it is not connected to the Internet, in this embodiment, it is first determined whether the client and the cloud detection server can be connected through the above step S202. If yes, it needs to send the above detection request to the cloud detection server, if not, go to step S203.

S203: If the network connection between the client and the cloud detection server is abnormal, the client determines the network security level corresponding to the currently acquired network configuration information according to the locally stored security detection rules; wherein the security detection rules include : If the URL is inconsistent with the URL corresponding to the wireless network pre-stored on the cloud detection server, the network security level is dangerous.

The above-mentioned step S203 may partially refer to the specific content of the above-mentioned step S103. In this embodiment, when the network connection between the client and the cloud detection server is abnormal (interruption or poor network speed, etc.), the security detection rules pre-stored on the client may be used to determine the network security level. Generally, the client can periodically obtain the security detection rules on the cloud detection server, or the cloud detection server regularly downloads the latest security detection rules to the client. The above security detection rules can be continuously updated or upgraded with business development.

S204: The client determines whether the network security level is the network security level to be repaired, and if so, performs a corresponding repair action on the network configuration information of the wireless network.

For this step S204, reference may be made to the specific content of the above-mentioned step S104, which will not be repeated herein.

In other embodiments of the present application, the network configuration information further includes the domain name system DNS of the WAN interface of the wide area network and the DNS of the dynamic host configuration protocol DHCP; then, the above step S203 specifically includes:

If the network connection between the client and the cloud detection server is abnormal, the client determines the network security level corresponding to the DNS in the currently acquired network configuration information according to the security detection rules stored locally; wherein, the security detection rules Including: if the DNS conforms to the first DNS security rule, the network security level is dangerous; if the DNS conforms to the second DNS security rule, the network security level is safe; if the DNS conforms to the third DNS security rule, the network security level is safe; The network security level is Warning.

Correspondingly, the above step S204 may specifically include the following steps:

The client determines whether the network security level is dangerous or warning, and if so, repairs the network configuration information.

Similarly, based on the methods provided by the above embodiments, the present application can detect the network security level that needs to be repaired (including tampering with the preset URL of the wireless network, etc.) through the cloud detection server according to the network configuration information of the wireless network, and Returning to the client, the client finally determines whether the network configuration information needs to be repaired accordingly, so as to ensure the security of the wireless network.

FIG. 4 is a flowchart of a method for detecting and repairing a network configuration of a wireless network according to an embodiment of the present application. In this embodiment, the method includes the following steps:

S301: The cloud detection server receives a detection request sent by a client carrying network configuration information obtained when the client connects to a wireless network; wherein the network configuration information at least includes a malicious Uniform Resource Locator URL preset by the wireless network.

As described above, after S101 and S102, the cloud detection server can receive a detection request sent by the client carrying the network configuration information obtained when the client connects to the wireless network; wherein, the network configuration information at least includes the wireless network preset Malicious Uniform Resource Locator URL.

Of course, in the embodiment of the present application, the above-mentioned network configuration information is not limited to the above-mentioned malicious URL, and may also include the Domain Name System DNS of the WAN interface of the WAN and the DNS of the Dynamic Host Configuration Protocol DHCP. The WAN (Wide Area Network, wide area network) is the port through which the network device connects to the external network, and criminals often tamper with the DNS of the WAN interface of the network connection device into malicious DNS. Malicious DNS steals users' private information and data (such as bank card account passwords, personal privacy, etc.) by parsing normal URLs to phishing websites or hosts controlled by criminals. The DHCP (Dynamic Host Configuration Protocol, Dynamic Host Configuration Protocol) is used to automatically assign IP (Internet Protocol, protocol for interconnection between networks) addresses to networks or network service providers. If the client connects to a network connection device with DHCP function and uses the automatic IP address acquisition, the DNS of the network connection device DHCP will be synchronized to the local client, so once the DNS of the network connection device DHCP is tampered with malicious DNS If this happens, all clients connecting to this network-connected device will be at great risk.

S302: The cloud detection server determines the network security level of the network configuration information according to a preset security detection rule;

In the embodiment of the present application, the security detection rules include: if the URL conforms to the first URL security rule, the network security level is dangerous; if the URL conforms to the second URL security rule, the network security level is safe; The URL conforms to the third URL security rule, and the network security level is a warning.

In practical applications, there is a hidden danger that other devices on the network side maliciously tamper with the network configuration information of the wireless network, and the tampering action includes tampering with a malicious URL preset by the wireless network. For example, delete the original malicious URL or add a non-malicious URL. Therefore, the above-mentioned security detection rule may be, for example: if the preset malicious URL is found to be inconsistent with the currently acquired malicious URL of the wireless network, the network security level of the wireless network is determined as dangerous. Of course, in other embodiments of the present application, the above-mentioned network security level may be determined according to the number of malicious URLs that are actually tampered with. For example, if the number of tampered with 1-10, the above-mentioned network security level is determined to be a warning; the number of tampered with is 10-50, determine the above network security level as dangerous; and so on.

In this embodiment of the present application, the above step S302 may further specifically include the following steps:

The cloud detection server determines the network security level of the network configuration information according to the preset security detection rules; wherein, the security detection rules include: if the DNS conforms to the first DNS security rule, the network security level is dangerous; for example, the DNS If the second DNS security rule is complied with, the network security level is safe; if the DNS complies with the third DNS security rule, the network security level is warning.

In this embodiment, the first DNS security rule may be located in a blacklist, and the blacklist records a malicious DNS list; the second DNS security rule may be located in a whitelist, and the whitelist records security DNS list; the third DNS security rule may be neither in the blacklist nor in the whitelist.

The manner of generating the blacklist and the whitelist in the cloud detection server is as described in S103 in the foregoing embodiment, and details are not described herein again.

S304: The cloud detection server returns the network security level to the client for the client to perform a repair action on the network configuration information whose security level is the network security level to be repaired.

The cloud detection server returns the network security level to the client for the client to perform a repair action on the network configuration information whose security level is the network security level to be repaired.

For example, the client determines whether the network security level is dangerous; if so, repairs the network configuration information. Generally, the configuration information of each detected wireless network (preset by the user) is pre-stored on the cloud detection server. When it is maliciously tampered with and needs to be repaired, it can be obtained by obtaining the above-mentioned cloud detection server. Until the configuration information of the wireless network is maliciously tampered with, the network configuration information of the wireless network can be restored accordingly. Of course, if it is determined that the network security level of the configuration information of the wireless network is safe, it does not need to be repaired.

In addition, in other embodiments of the present application, if the above-mentioned network configuration information includes the domain name system DNS of the WAN interface of the wide area network and the DNS of the dynamic host configuration protocol DHCP; then the above-mentioned step S104 may specifically include the following steps:

The client determines whether the network security level is dangerous or warning, and if so, repairs the network configuration information.

Based on the methods provided by the above embodiments, the cloud detection server in this application can detect the network configuration information carried in the detection request sent by the client, and the cloud detection server can detect the network security level (including the wireless network security level) that needs to be repaired. The preset URL is tampered with, etc.) and returned to the client, and finally the client determines whether the network configuration information needs to be repaired accordingly, so as to ensure the security of the wireless network.

On the basis of FIG. 4 , as shown in FIG. 5 , before S304 , the following steps may also be performed:

S303: Determine whether the network connection between the cloud detection server and the client is normal.

In the actual application process, the network connection between the cloud detection server and the client is often abnormal, and the cloud detection server cannot return the network security level to the client. In order to solve this problem, in this embodiment, after the cloud detection server detects and determines the network security level, S303 is used to judge whether the network connection between the cloud detection server and the client is normal, if the connection is normal, then step S304 is performed; if the connection is abnormal , step S305 is executed.

Correspondingly, S304 includes: if the network connection between the cloud detection server and the client is normal, the cloud detection server returns the network security level to the client for the client to check that the security level is the network security level to be repaired The network configuration information is repaired.

S305: If the network connection between the cloud detection server and the client is abnormal, the cloud detection server stores the network security level, and when the network connection between the cloud detection server and the client is normal, the network security The level is returned to the client.

Based on the methods provided by the above embodiments, the present application can store the network security level first when the network connection between the cloud detection server and the client is abnormal, and store the network security level when the network connection between the cloud detection server and the client is normal. The network security level is returned to the client. Thus, the client can receive the network security level returned by the cloud detection server, so as to better ensure the security of the wireless network.

6 is a block diagram of an apparatus for detecting and repairing a network configuration of a wireless network according to an embodiment of the present application, wherein the functions that can be implemented by each unit included in the apparatus are the same as the functions that can be implemented by each step included in the above method , so the device can refer to the specific content of the above method. Specifically, the above device includes:

The obtaining unit 101 is configured to obtain network configuration information of a wireless network connected by a client; wherein, the network configuration information at least includes a malicious Uniform Resource Locator URL preset by the wireless network;

A sending unit 102, configured to send a detection request carrying the above-mentioned network configuration information to the cloud detection server;

The receiving unit 103 is configured to receive the network security level corresponding to the detection request returned by the cloud detection server; wherein, the network security level is determined by the cloud detection server according to a preset security detection rule;

The determining unit 104 is configured to determine whether the network security level is the network security level to be repaired, and if so, perform a corresponding repairing action on the network configuration information of the wireless network.

Based on the device provided by the above embodiment, the network security level that needs to be repaired (including tampering with the preset URL of the wireless network, etc.) can be detected by the cloud detection server according to the network configuration information of the wireless network, and returned to the client, Ultimately, the client determines whether the network configuration information needs to be corrected accordingly, so as to ensure the security of the wireless network.

In the embodiment of the present application, the receiving unit 103 is specifically configured to: receive the network security level returned by the cloud detection server and determined according to the security detection rules preset on the cloud detection server; wherein, the security detection rules include: such as URL and If the URL corresponding to the wireless network pre-stored on the cloud detection server is inconsistent, the network security level is dangerous.

Correspondingly, the determining unit 104 is specifically configured to: determine whether the network security level is dangerous, and if so, repair the network configuration information.

In the embodiment of the present application, the network configuration information further includes the domain name system DNS of the WAN interface of the wide area network and the DNS of the dynamic host configuration protocol DHCP; then, the receiving unit 103 is specifically configured to:

Receive the network security level determined according to the security detection rules preset on the cloud detection server returned by the cloud detection server; wherein, the security detection rules include: if the DNS complies with the first DNS security rule, the network security level is dangerous; If the DNS conforms to the second DNS security rule, the network security level is safe; if the DNS conforms to the third DNS security rule, the network security level is warning.

Correspondingly, the determining unit 104 is specifically configured to: determine whether the network security level is a danger or a warning, and if so, repair the network configuration information.

7 is a block diagram of an apparatus for detecting and repairing a network configuration of a wireless network according to another embodiment of the present application, wherein the functions that can be implemented by each unit included in the apparatus and the functions that can be implemented by each step included in the above method are the same, so the device can refer to the specific content of the above method. Specifically, the above device includes:

Obtaining unit 201, configured to obtain network configuration information of a wireless network connected by a client; wherein, the network configuration information at least includes a malicious Uniform Resource Locator URL preset by the wireless network;

The first judging unit 202 is configured to judge whether the network connection between the client and the cloud detection server is normal;

The determining unit 203 is configured to determine the network security level corresponding to the currently acquired network configuration information according to the locally stored security detection rule when the network connection between the client and the cloud detection server is abnormal; wherein the security The detection rules include: if the URL is inconsistent with the URL corresponding to the wireless network pre-stored on the cloud detection server, the network security level is dangerous;

The second determination unit 204 is configured to determine whether the network security level is the network security level to be repaired, and if so, perform a corresponding repair action on the network configuration information of the wireless network.

Based on the device provided by the above embodiment, the network security level that needs to be repaired (including tampering with the preset URL of the wireless network, etc.) can be detected by the cloud detection server according to the network configuration information of the wireless network, and returned to the client, Ultimately, the client determines whether the network configuration information needs to be corrected accordingly, so as to ensure the security of the wireless network.

In the embodiment of the present application, the network configuration information further includes the domain name system DNS of the WAN interface of the wide area network and the DNS of the dynamic host configuration protocol DHCP; then, the determining unit 203 is specifically configured to:

If the network connection between the client and the cloud detection server is abnormal, determine the network security level corresponding to the DNS in the currently obtained network configuration information according to the security detection rules stored locally; wherein, the security detection rules include: If the DNS complies with the first DNS security rule, the network security level is dangerous; if the DNS complies with the second DNS security rule, the network security level is safe; if the DNS complies with the third DNS security rule, the network security level Level is Warning.

Correspondingly, the determining unit 104 is specifically configured to: determine whether the network security level is a danger or a warning, and if so, repair the network configuration information.

In the same way, based on the device provided by the above embodiment, the network security level that needs to be repaired (including tampering with the preset URL of the wireless network, etc.) can be detected through the cloud detection server according to the network configuration information of the wireless network and returned to The client finally determines whether the network configuration information needs to be repaired accordingly, so as to ensure the security of the wireless network.

FIG. 8 is a block diagram of an apparatus for detecting and repairing a network configuration of a wireless network according to another embodiment of the present application, wherein the functions that can be implemented by each unit included in the apparatus and the functions that can be implemented by each step included in the above method are the same, so the device can refer to the specific content of the above method. Specifically, the above device includes:

A receiving unit 301, configured to receive a detection request sent by a client carrying network configuration information obtained when the client connects to a wireless network; wherein the network configuration information at least includes a malicious Uniform Resource Locator URL preset by the wireless network;

A detection unit 302, configured to determine the network security level of the network configuration information according to a preset security detection rule;

The returning unit 303 is configured to return the network security level to the client, for the client to perform a repair action on the network configuration information whose security level is the network security level to be repaired.

Based on the device provided by the above embodiment, the cloud detection server can detect the network configuration information carried in the detection request sent by the client, and the cloud detection server can detect the network security level that needs to be repaired (including the preset wireless network security level). The URL is tampered with, etc.) and returned to the client, and finally the client determines whether the network configuration information needs to be repaired accordingly, so as to ensure the security of the wireless network.

The security detection rules include: if the URL conforms to the first URL security rule, the network security level is dangerous; if the URL conforms to the second URL security rule, the network security level is safe; if the URL conforms to the third URL security rule rule, the network security level is warning.

The network configuration information also includes the domain name system DNS of the WAN interface of the wide area network;

Then the detection unit 302 is specifically used for:

The network security level of the network configuration information is determined according to a preset security detection rule; wherein, the security detection rule includes: if the DNS complies with the first DNS security rule, the network security level is dangerous; if the DNS complies with the second DNS security rule, the network security level is dangerous; DNS security rules, the network security level is safe; if the DNS conforms to the third DNS security rule, the network security level is warning.

The network configuration information also includes the domain name system DNS of the WAN interface of the wide area network;

Then the detection unit 302 is specifically used for:

The network security level of the network configuration information is determined according to a preset security detection rule; wherein, the security detection rule includes: if the DNS complies with the first DNS security rule, the network security level is dangerous; if the DNS complies with the second DNS security rule, the network security level is dangerous; DNS security rules, the network security level is safe; if the DNS conforms to the third DNS security rule, the network security level is warning.

Before returning to unit 303, it also includes:

a judging unit for judging whether the network connection between the cloud detection server and the client is normal;

The returning unit is specifically used for:

When the network connection between the cloud detection server and the client is abnormal, the cloud detection server stores the network security level; and when the network connection between the cloud detection server and the client is normal, the network security level is stored in the cloud detection server. Return to the client, for the client to perform a repair action on the network configuration information whose security level is the network security level to be repaired.

Based on the device provided by the above embodiment, when the network connection between the cloud detection server and the client is abnormal, the network security level can be stored first, and when the network connection between the cloud detection server and the client is normal, the network security level can be stored. The level is returned to the client. Thus, the client can receive the network security level returned by the cloud detection server, so as to better ensure the security of the wireless network.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-persistent memory in computer readable media, random access memory (RAM) and/or non-volatile memory in the form of, for example, read only memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer-readable media includes both persistent and non-permanent, removable and non-removable media, and storage of information may be implemented by any method or technology. Information may be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), Flash Memory or other memory technology, Compact Disc Read Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media, such as modulated data signals and carrier waves.

It should also be noted that the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device comprising a series of elements includes not only those elements, but also Other elements not expressly listed, or which are inherent to such a process, method, article of manufacture, or apparatus are also included. Without further limitation, an element defined by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article of manufacture or apparatus that includes the element.

It will be appreciated by those skilled in the art that the embodiments of the present application may be provided as a method, a system or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The above descriptions are merely examples of the present application, and are not intended to limit the present application. Various modifications and variations of this application are possible for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included within the scope of the claims of this application.

Claims (8)

1. A network configuration detection and repair method of a wireless network, characterized in that, comprising: The cloud detection server receives a detection request sent by the client carrying the network configuration information obtained when the client connects to a wireless network; wherein, the network configuration information at least includes a malicious Uniform Resource Locator URL preset by the wireless network; The cloud detection server determines the network security level of the network configuration information according to the preset security detection rules; wherein, the security detection rules include: if the URL conforms to the first URL security rule, the network security level is dangerous; Meet the second URL security rule, then the network security level is safe; if the URL meets the third URL security rule, then the network security level is a warning; The first URL security rule is: if it is found that the preset malicious URL is inconsistent with the currently acquired malicious URL of the wireless network, the network security level of the wireless network is determined as dangerous; The cloud detection server returns the network security level to the client for the client to perform a repair action on the network configuration information whose security level is the network security level to be repaired. 2. The method of claim 1, wherein the network configuration information further comprises a Domain Name System DNS of a wide area network (WAN) interface; The cloud detection server determines the network security level of the network configuration information according to the preset security detection rules, which specifically includes: The cloud detection server determines the network security level of the domain name system DNS of the WAN interface of the WAN according to the preset security detection rules; wherein, the security detection rules include: if the DNS conforms to the first DNS security rule, the network security level is: Dangerous; if the DNS conforms to the second DNS security rule, the network security level is safe; if the DNS conforms to the third DNS security rule, the network security level is warning. 3. The method of claim 1, wherein the network configuration information further comprises the DNS of the Dynamic Host Configuration Protocol (DHCP); The cloud detection server determines the network security level of the network configuration information according to the preset security detection rules, which specifically includes: The cloud detection server determines the network security level of the DNS of the dynamic host configuration protocol DHCP according to the preset security detection rule; wherein, the security detection rule includes: if the DNS conforms to the first DNS security rule, the network security level is: Dangerous; if the DNS conforms to the second DNS security rule, the network security level is safe; if the DNS conforms to the third DNS security rule, the network security level is warning. 4. The method of claim 1, wherein before the cloud detection server returns the network security level to the client, the method further comprises: Determine whether the network connection between the cloud detection server and the client is normal; If the network connection between the cloud detection server and the client is abnormal, the cloud detection server stores the network security level, and returns the network security level when the network connection between the cloud detection server and the client is normal. to the client. 5. A network configuration detection and repair device of a wireless network, characterized in that, comprising: a receiving unit, configured to receive a detection request sent by a client carrying network configuration information obtained when the client connects to a wireless network; wherein the network configuration information at least includes a malicious Uniform Resource Locator URL preset by the wireless network; A detection unit, configured to determine the network security level of the network configuration information according to a preset security detection rule; wherein, the security detection rule includes: if the URL complies with the first URL security rule, the network security level is dangerous; If the URL complies with the second URL security rule, the network security level is safe; if the URL complies with the third URL security rule, the network security level is a warning; the first URL security rule is: if a preset malicious code is found If the URL is inconsistent with the currently obtained malicious URL of the wireless network, the network security level of the wireless network is determined to be dangerous; The returning unit is configured to return the network security level to the client, so that the client can perform a repair action on the network configuration information whose security level is the network security level to be repaired. 6. The apparatus of claim 5, wherein the network configuration information further comprises a Domain Name System DNS of a wide area network WAN interface; The detection unit is specifically used for: Determine the network security level of the domain name system DNS of the WAN interface of the WAN according to the preset security detection rule; wherein, the security detection rule includes: if the DNS conforms to the first DNS security rule, the network security level is dangerous; If the DNS conforms to the second DNS security rule, the network security level is safe; if the DNS conforms to the third DNS security rule, the network security level is warning. 7. The apparatus of claim 5, wherein the network configuration information further comprises DNS of the Dynamic Host Configuration Protocol (DHCP); The detection unit is specifically used for: Determine the network security level of the DNS of the dynamic host configuration protocol DHCP according to a preset security detection rule; wherein, the security detection rule includes: if the DNS conforms to the first DNS security rule, the network security level is dangerous; If the DNS conforms to the second DNS security rule, the network security level is safe; if the DNS conforms to the third DNS security rule, the network security level is warning. 8. The apparatus of claim 7, wherein the apparatus further comprises: a judging unit for judging whether the network connection between the cloud detection server and the client is normal; The returning unit is specifically used for: When the network connection between the cloud detection server and the client is abnormal, the cloud detection server stores the network security level; and when the network connection between the cloud detection server and the client is normal, the network security level is stored in the cloud detection server. Return to the client, for the client to perform a repair action on the network configuration information whose security level is the network security level to be repaired.

Images