An operating system identification method, storage medium and device based on xgboost algorithm

Abstract

The invention discloses an operating system identification method, storage medium and equipment based on the XGBoost algorithm. Firstly, based on the third-party fingerprint library P0f, its feature dimension is optimized to remove repetitive problems caused by fuzzy matching and precise matching; Data analysis in real traffic generates test set data; secondly, Windows7 and Windows10 data incremental training improves recognition efficiency; thirdly, C4.5 decision tree algorithm is used to verify the data before and after the increment, and the results show the recognition accuracy after incremental training Greatly improved; finally, the XGBoost algorithm was introduced, and the layered architecture framework was used to identify unknown fingerprints, improving the recognition accuracy and reducing false positives and missed negatives.

Description

technical field [0001] The invention belongs to the technical field of computers, and in particular relates to an operating system identification method, storage medium and equipment based on an XGBoost algorithm. Background technique [0002] The development and growth of the network has brought more and more network security problems while facilitating people's resource sharing and information communication. As small as the leakage of personal privacy, as large as the paralysis of servers and problems with national infrastructure threaten human security. If you want to effectively prevent malicious attackers from attacking the network, users need to use a vulnerability scanner in advance to detect potential security risks in the system and take corresponding solutions in a timely manner. Some operating system types and versions have some well-known security vulnerabilities, and network attackers can use these security vulnerabilities as a starting point for network attack...

AI Technical Summary

Problems solved by technology

[0004] The technical problem to be solved by the present invention is to provide an operating system identification method, storage medium and equipment based on the XGBoost algorithm to identify the operating system in a passive manner to solve the problem that active detection may fail ;Catch the data in the real traffic to optimize the fingerprint library to improve the recognition efficiency; use the integrated learning XGBoost algorithm to introduce the idea of ​​gradient descent to improve the recognition accuracy and speed

Images