CN114116789A

CN114116789A - A method of WIFI aggregation analysis

Info

Publication number: CN114116789A
Application number: CN202010866723.5A
Authority: CN
Inventors: 戚鹏飞
Original assignee: Nanjing Stratus Intelligent Technology Co ltd
Current assignee: Nanjing Stratus Intelligent Technology Co ltd
Priority date: 2020-08-26
Filing date: 2020-08-26
Publication date: 2022-03-01

Abstract

The invention discloses a method for WIFI aggregation analysis, comprising the following steps: S1, connecting a mobile phone to a computer, and acquiring all the connected WIFI detailed information from the mobile phone; S2, filtering the acquired WIFI information; S3, connecting the mobile phone to The detailed information extracted from the data is stored in the Neo4j database after corresponding classification, and stored in the form of nodes; S4, data analysis is carried out on the classified data, and the data with definite relationship, suspected relationship and no relationship is analyzed and checked out; S5. Further organize the uploaded data, and display the results in the form of a knowledge graph. By using software for analysis, the present invention analyzes the data that cannot be intuitive, which can save the time of the staff, thereby improving the efficiency; by analyzing the WIFI connection data that is not easy to find, it can search for important clues in the data that is easy to be ignored, In the criminal investigation analysis, the connection between others can be obtained indirectly.

Description

WIFI aggregation analysis method

Technical Field

The invention relates to the field of electronic material evidence analysis, in particular to a WIFI aggregation analysis method.

Background

Along with the continuous development of scientific technology, the effect of electron material evidence as the evidence is more and more obvious in the criminal case, however, after solving a case personnel and obtaining electron material evidence, will investigate personnel in the electron material evidence, carry out the analysis to its WIFI information, WIFI information analysis has following difficult point however:

1. WIFI information cannot be obtained visually;

after the WIFI is disconnected, the WIFI data are stored in a memory of the mobile phone and cannot be simply acquired;

3. the comparison with others cannot be carried out;

4. different mobile phone models, the WIFI information is not extracted.

Disclosure of Invention

The technical problem to be solved by the invention is to overcome the defects of the prior art and provide a WIFI aggregation analysis method.

In order to solve the technical problems, the invention provides the following technical scheme:

the invention provides a WIFI aggregation analysis method, which comprises the following steps:

s1, connecting the mobile phone with a computer, and acquiring all connected WIFI detailed information from the mobile phone;

s2, filtering the acquired WIFI information;

s3, storing the detailed information extracted from the mobile phone into a Neo4j database after corresponding classification, and storing the detailed information in a node form;

s4, carrying out data analysis on the classified data, and analyzing and checking the data with determined relation, suspected relation and irrelevant relation;

and S5, further sorting the uploaded data, and displaying the result in a knowledge graph form.

As a preferred technical solution of the present invention, in step S2, filtering is performed after public WIFI is divided into blacklists, so as to avoid interference of irrelevant data.

As a preferred technical solution of the present invention, in step S3, the owner NAME, WIFI _ MAC, WIFI _ PASSWORD, and WIFI _ connection are classified correspondingly and stored in the Neo4j database;

the Neo4j above follows the attribute graph data model, supports UNIQUE constraints by using apache lucence support indexes, supports complete ACID rules, supports query-enabled data exports to JSON and XLS formats, contains a UI for executing CQL commands: neo4j data browser, using native graphics libraries and native GPEs, provides RESTAPI accessible by any programming language, provides Java scripts accessible through any UIMVC framework, supports two javaapis: CypherAPI and native Java api to develop Java applications.

As a preferred embodiment of the present invention, in step S4, there are only the following three possibilities for the collision result:

1. the two people determine that the same WIFI is connected;

2. two persons are suspected to be connected with the same WIFI;

3. two people are not connected with the same WIFI;

when the WIFI _ MACs of the data extracted by the two persons are the same, the other information does not need to be compared, and the two persons need to be connected with the same WIFI to store and upload the information of the two persons; and when the extracted data cannot obtain the WIFI _ MAC, comparing the WIFI _ NAME with the WIFI _ PASSWORD, if the data results are the same, storing and uploading the information of the two persons, and if the data results are different, enabling the two persons to have no relationship.

As a preferred technical solution of the present invention, in step S5, it is only necessary to analyze the WIFI _ connection time of the display result as to whether the same WIFI is connected in the same time period.

Compared with the prior art, the invention has the following beneficial effects:

1: according to the invention, software is adopted for analysis, and data which cannot be visualized is analyzed, so that the time of workers can be saved, and the efficiency is improved.

2: according to the method and the device, the WIFI connection data which are not easy to find are analyzed, important clues are searched in the data which are easy to be ignored by people, and the contact among other people can be indirectly obtained in criminal investigation analysis.

3: the invention can gradually obtain more detailed relational network by storing the acquired data in the database, thereby being beneficial to subsequent case handling.

Drawings

The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the principles of the invention and not to limit the invention. In the drawings:

FIG. 1 is a flow chart of an analytical method of the present invention;

fig. 2 is a schematic diagram illustrating filtering of WIFI information in step S2 according to the present invention;

FIG. 3 is a schematic diagram of data analysis in the present invention.

Detailed Description

The preferred embodiments of the present invention will be described in conjunction with the accompanying drawings, and it will be understood that they are described herein for the purpose of illustration and explanation and not limitation.

Example 1

s1, connecting the mobile phone with a computer, and acquiring all connected WIFI detailed information from the mobile phone, wherein once the mobile phone is connected with a certain WIFI, the detailed WIFI information is stored in a file format in a mobile phone file, and due to the limitation of mobile phone specification, the form and address of the WIFI information file are not influenced no matter the mobile phone system, the brand and the model are different, so that the detailed WIFI information of the mobile phone can be directly acquired;

s2, filtering the acquired WIFI information, and finding out that a large amount of public WIFI appears in the mobile phone of the mobile phone owner during actual operation, for example: the large amount of redundant data not only can cause interference on a WIFI collision result, but also can occupy a large amount of invalid information;

Further, in step S2, filtering public WIFI after being divided into blacklists to avoid interference of irrelevant data, before importing data into the database, filtering data of the public WIFI for one time to filter the public WIFI in a form of a blacklist, for example: CMCC, Chinanet, etc., so that interference of invalid data can be avoided, and then processing is performed in the form of blacklist, and both adding and maintaining new filter lists at a later stage can be more convenient and have higher extensibility.

In step S3, performing corresponding classification according to the owner NAME, WIFI _ MAC, WIFI _ PASSWORD, and WIFI _ connection, and storing the classification into a Neo4j database;

the Neo4j above follows the attribute graph data model, supports UNIQUE constraints by using apache lucence support indexes, supports complete ACID rules, supports query-enabled data exports to JSON and XLS formats, contains a UI for executing CQL commands: neo4j data browser, using native graphics libraries and native GPEs, provides RESTAPI accessible by any programming language, provides Java scripts accessible through any UIMVC framework, supports two javaapis: CypherAPI and native JavaAPI to develop Java application programs;

the advantages of Neo4j are that it is easy to represent concatenated data and to represent semi-structured data, more data can be quickly and easily concatenated, retrieved/traversed/navigated, Neo4jCQL query language commands are in a readable format, it is very easy to learn, use a simple and powerful data model, it does not require complex concatenations to retrieve concatenated/related data, it is easy to retrieve neighboring nodes or relationship details without concatenations or indexes.

In step S4, there are only three possibilities for its collision result:

1. the two people determine that the same WIFI is connected;

2. two persons are suspected to be connected with the same WIFI;

3. two people are not connected with the same WIFI;

In step S5, as to whether the same WIFI is connected in the same time period, it is only necessary to analyze the WIFI _ connection time of the display result, further sort the uploaded data, and display the result in the form of a knowledge graph, thereby finding whether the owner and the other person are connected to the same WIFI or suspected to be connected to the same WIFI.

According to the invention, software is adopted for analysis, and data which cannot be visualized is analyzed, so that the time of workers can be saved, and the efficiency is improved; by analyzing the WIFI connection data which are not easy to find, important clues are searched in the data which are easy to be ignored by people, and the contact among other people can be indirectly obtained in criminal investigation analysis; by storing the acquired data in the database, more detailed relational networks can be gradually acquired, which is beneficial to subsequent case handling.

Finally, it should be noted that: although the present invention has been described in detail with reference to the foregoing embodiments, it will be apparent to those skilled in the art that changes may be made in the embodiments and/or equivalents thereof without departing from the spirit and scope of the invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. a method for WIFI aggregation analysis, is characterized in that, comprises the following steps:

S1. Connect the mobile phone to the computer, and obtain all the connected WIFI details from the mobile phone;

S2. Filter the acquired WIFI information;

S3. The detailed information extracted from the mobile phone is stored in the Neo4j database after corresponding classification, and saved in the form of nodes;

S4. Perform data analysis on the classified data, and analyze and check out the data with definite relationship, suspected relationship and no relationship;

S5. Further organize the uploaded data, and display the results in the form of a knowledge graph.

2 . The method for WIFI aggregation analysis according to claim 1 , wherein in step S2 , all public WIFIs are divided into a blacklist and then filtered to avoid interference of irrelevant data. 3 .

3. The method for WIFI aggregation analysis according to claim 1, wherein in step S3, corresponding classification is performed according to the host name, WIFI_NAME, WIFI_MAC, WIFI_PASSWORD and WIFI_CONNECTTIME, and stored in the Neo4j database;

The above Neo4j follows the property graph data model, supports indexes by using Apache Lucence, supports UNIQUE constraints, supports full ACID rules, supports query data export to JSON and XLS formats, includes a UI for executing CQL commands: Neo4j Data Browser, Using native graphics library and native GPE, it provides RESTAPI that can be accessed by any programming language, provides Java scripts that can be accessed through any UIMVC framework, and supports two JavaAPIs: CypherAPI and NativeJavaAPI to develop Java applications.

4. The method for WIFI aggregation analysis according to claim 1, wherein in step S4, there are only the following three possibilities for the collision result:

1. Make sure that the two have connected to the same WIFI;

2. The two are suspected to have connected to the same WIFI;

3. The two have never been connected to the same WIFI;

When the WIFI_MAC of the extracted data is the same, there is no need to compare the rest of the information. The two must be connected to the same WIFI and save and upload their information; when the extracted data cannot be obtained by WIFI_MAC, compare their WIFI_NAME and WIFI_PASSWORD , if the data results are the same, there is a suspected relationship, and the information of the two is saved and uploaded. If they are different, the two are not related.

5 . The method for WIFI aggregation analysis according to claim 1 , wherein, in step S5 , as to whether the same WIFI has been connected in the same time period, only the WIFI_CONNECTTIME of the displayed result needs to be analyzed. 6 .