A method and equipment for detecting man-in-the-middle attack by user equipment

TLDR: In this article, the authors proposed a method for detecting man-in-the-middle attacks by user equipment, which comprises the following steps: transmitting a plurality of corresponding TCP (Transmission Control Protocol) handshake requests to the plurality of random IP (Internet Protocol) addresses; determining TCP handshake success count corresponding to the corresponding TCP handshake requests according to whether the corresponding PT handshake requests succeed in preset time; and determining whether manin the middle attack does not exist or not in a current network of the user equipment if the TCP handshake successful count is less than or equal to a TCP handshake

Abstract: The purpose of the invention is to provide a method for detecting man-in-the-middle attack by user equipment. The method comprises the following steps: transmitting a plurality of corresponding TCP (Transmission Control Protocol) handshake requests to a plurality of random IP (Internet Protocol) addresses; determining TCP handshake success count corresponding to the corresponding TCP handshake requests according to whether the corresponding TCP handshake requests succeed in preset time; and determining whether man-in-the-middle attack does not exist or not in a current network of the user equipment if the TCP handshake success count is less than or equal to a TCP handshake success threshold. According to the method disclosed by the invention, SSLSniff man-in-the-middle attack, SSLStrip man-in-the-middle attack and website distortion man-in-the-middle attack in the man-in-the-middle attack can be actively detected, the coverage area is wide, the man-in-the-middle attack is rapidly recognized, the user waiting time is greatly shortened, and the user side can conveniently take corresponding defensive measures in the shortest time.