A message recognition method of position sensitive feature entropy fingerprints

Abstract

The application discloses a message identification method of position-sensitive feature entropy fingerprint, comprising the following steps: grabbing a certain number of same type messages through a network; grouping and aligning the messages, preferentially ensuring that messages with equal length are divided into a group, and dividing the messages into N groups; longitudinally slicing each group of messages; taking each slice data of each group of messages as an array, calculating information entropy array E of each array, and obtaining information entropy group En of the N groups; judging the information entropy characteristics of En, obtaining specific characteristic information entropy, recording the position of the specific characteristic information entropy in the array E as a feature, and obtaining a characteristic fingerprint with position information and information entropy; and matching messages by using the characteristic fingerprint. The application can quickly form a message characteristic fingerprint through network packet classification, does not need manual analysis, is convenient and fast, can be used for learning and matching of multiple dimensions such as protocol types and manufacturer characteristics of equipment, and meets the application of multiple scenes.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, in particular to a message identification method of position-sensitive feature entropy fingerprint. BACKGROUND

[0002] Industrial control refers to industrial automation control, which is mainly realized by combining electronic and electrical, mechanical and software. That is, industrial control or factory automation control. It mainly refers to using computer technology, microelectronic technology and electrical means to make the production and manufacturing process of the factory more automated, efficient, accurate, and controllable and visual.

[0003] In the field of industrial security, it is often necessary to identify the manufacturer, type or other information of the device through messages. The traditional identification method is to extract features manually, which is low in efficiency and heavy in workload. SUMMARY

[0004] The present application provides a message identification method of position-sensitive feature entropy fingerprint, comprising:

[0005] A certain number of messages of the same type are captured through a network;

[0006] The messages are grouped and aligned, and messages of the same length are preferentially divided into a group, and the messages are divided into N groups;

[0007] Each group of messages after grouping is subjected to longitudinal slicing processing;

[0008] Each slice data of each group of messages is taken as an array, the information entropy array E of each array is calculated, and the information entropy group En of N groups is obtained;

[0009] The calculated information entropy array En is subjected to information entropy feature determination to obtain information entropy with specific features, and the position of the information entropy in the array E is also recorded as a feature, thereby obtaining a feature fingerprint with position information and corresponding information entropy;

[0010] The messages are captured, and the obtained feature fingerprint is used for message matching.

[0011] The message identification method of position-sensitive feature entropy fingerprint as described above, wherein the slice length L should satisfy L >= log2(m), wherein m is the number of messages in each group.

[0012] The message identification method of position-sensitive feature entropy fingerprint as described above, wherein the information entropy with specific features is obtained by taking elements with information entropy of 0 or full entropy as key features, and recording an information entropy range for other numerical entropies, i.e., recording the maximum and minimum values of information entropy.

[0013] The message recognition method of the position-sensitive feature entropy fingerprint as described above, wherein the message matching specifically comprises the following sub-steps:

[0014] A certain number of messages are acquired through a network, and a group of messages are extracted;

[0015] The messages are sliced and the information entropy is calculated, and a fingerprint with position information and corresponding information entropy is obtained;

[0016] The similarity of the fingerprint is determined by comparing the position+information entropy feature fingerprint in the message feature operation;

[0017] The threshold of the fingerprint similarity determination is set for determination, if the similarity of the fingerprint is greater than the preset threshold, it is considered that the message matching is successful, if the similarity of the fingerprint is less than the preset threshold, it is considered that the message matching fails.

[0018] The application further provides a computer readable storage medium, characterized in that the computer readable storage medium contains one or more program instructions, and the one or more program instructions are used for executing the message recognition method of the position-sensitive feature entropy fingerprint of any one of the above.

[0019] The application has the following beneficial effects: after the network packet is classified, the fingerprint information of a message is quickly formed, manual analysis is not required, it is convenient and fast, can be used for learning and matching of multiple dimensions such as protocol type, equipment manufacturer characteristics, and meets the application of multiple scenes. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0021] Figure 1 It is a message recognition method flow chart of a position-sensitive feature entropy fingerprint provided by the first embodiment of the present application. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0023] Embodiment one

[0024] Referring to Figure 1 , the embodiment one of the present application provides a message identification method of position sensitive feature entropy fingerprint, comprising message feature learning operation and message matching operation.

[0025] (1) The message feature learning operation specifically comprises:

[0026] Step 110, a certain number of same type messages are grabbed through the network;

[0027] For example, a certain type of industrial protocol, such as protocol type, device manufacturer feature, etc., or messages classified by other ways.

[0028] Step 120, the messages are grouped and aligned, and messages of equal length are preferentially divided into a group, and the messages are divided into N groups;

[0029] Step 130, each group of messages after grouping is subjected to longitudinal slicing processing;

[0030] The slice length L (bit) should be changed to satisfy L >= log2 (m), wherein m is the number of messages in each group.

[0031] Step 140, each slice data of each group of messages is taken as an array, the information entropy array E of each array is calculated, and the information entropy group En of all groups is obtained.

[0032] Step 150, the calculated information entropy array En is subjected to information entropy feature determination, information entropy with specific features is obtained, and the position of the information entropy in the array E is also recorded as a feature, thereby obtaining a feature fingerprint with position information + corresponding information entropy;

[0033] Among them, the information entropy with specific features is specifically: the elements with information entropy of 0 or full entropy are taken as key features, and the entropy of other numerical values is recorded as an information entropy range, i.e. the maximum and minimum values of information entropy are recorded.

[0034] (2) The message matching operation specifically comprises: step 160, grabbing messages and using the obtained feature fingerprint to match the messages.

[0035] Among them, the message matching specifically comprises the following sub-steps:

[0036] Step S1, a certain number of messages are obtained through the network, and a group of messages are extracted.

[0037] Step S2, the messages are sliced and the information entropy is calculated, and a fingerprint with position information and corresponding information entropy is obtained;

[0038] Step S3, determine the similarity of the fingerprints by comparing the position+information entropy feature fingerprints in the message feature operation.

[0039] Step S4, determine by the set fingerprint similarity determination threshold, if the fingerprint similarity degree is greater than the preset threshold, it is considered that the message matching is successful, if the fingerprint similarity degree is less than the preset threshold, it is considered that the message matching fails.

[0040] In the embodiment of the application, for different types of network messages, different types of variation trees can be constructed by adjusting the positions of the node variables or the container variables to match different types of network messages.

[0041] Corresponding to the above-mentioned embodiments, the embodiment of the application provides a message identification device of position-sensitive feature entropy fingerprint, the system comprises at least one memory and at least one processor.

[0042] The memory is used to store one or more program instructions.

[0043] The processor is used to run one or more program instructions to execute a message identification method of position-sensitive feature entropy fingerprint.

[0044] Corresponding to the above-mentioned embodiments, the embodiment of the application provides a computer readable storage medium, the computer storage medium contains one or more program instructions, and the one or more program instructions are used to be executed by the processor to execute a message identification method of position-sensitive feature entropy fingerprint.

[0045] The embodiment of the application discloses a computer readable storage medium, the computer readable storage medium stores computer program instructions, when the computer program instructions run on the computer, make the computer execute the above-mentioned message identification method of position-sensitive feature entropy fingerprint.

[0046] In the embodiment of the application, the processor can be an integrated circuit chip with signal processing capability. The processor can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0047] The disclosed methods, steps, and logic block diagrams in the embodiments of the present application can be implemented or performed with a general- purpose processor, a special purpose processor, or any other processor. The steps of the methods disclosed in the embodiments of the present application can be directly embodied to a hardware code, a processor, or a combination of software modules and hardware modules in the processor. The software modules can reside in memories, such as random access memory (RAM), flash memory, read only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically EPROM (EEPROM), a register, or other forms of storage. The processor reads information in the memories and completes the steps of the above methods with the aid of hardware.

[0048] The storage medium can be a memory, such as a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memory.

[0049] The non-volatile memory can be a read only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), or a flash memory.

[0050] The volatile memory can be a random access memory (RAM) used as an external cache. By way of example, and not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DRRAM).

[0051] The storage medium described in the embodiments of the present application is intended to include, but not limited to, these and any other suitable types of memory.

[0052] Those skilled in the art should be aware that, in one or more examples described above, functions described by the present application can be implemented in combination of hardware and software. When the software is applied, the corresponding functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium. The computer readable medium includes computer storage medium and communication medium, wherein the communication medium includes any medium that facilitates transfer of a computer program from one place to another. The storage medium can be any available medium accessible by a general or special purpose computer.

[0053] The above detailed description further illustrates the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application should be included in the protection scope of the present application.

Claims

1. A message recognition method based on location-sensitive entropy fingerprints, characterized in that, include: Capture a certain number of messages of the same type from the network; The messages are grouped and aligned, prioritizing messages of equal length to be grouped together, and the messages are divided into N groups. Each group of packets after grouping is processed by vertical slicing; Treat each slice of data in each group of messages as an array, calculate the information entropy array E of each array, and obtain the information entropy array En of N groups; The information entropy array En is evaluated for information entropy features. Information entropy with specific features is obtained, and the position of these information entropy in array E is also recorded as a feature. Thus, a feature fingerprint with position information and corresponding information entropy is obtained. Specifically, information entropy with specific features is obtained by taking elements with information entropy of 0 or full entropy as key features, and recording the entropy of other values ​​as an information entropy range, that is, recording the maximum and minimum information entropy values. Capture the messages and use the obtained feature fingerprints to match the messages.

2. The message recognition method based on location-sensitive entropy fingerprints as described in claim 1, characterized in that, The slice length L satisfies L≥log2(m), where m is the number of messages in each packet.

3. The message recognition method based on location-sensitive entropy fingerprints as described in claim 1, characterized in that, Message matching specifically includes the following sub-steps: Obtain a certain number of messages from the network and extract a set of messages; The message is sliced ​​and its information entropy is calculated to obtain a fingerprint with location information and corresponding information entropy. The similarity of fingerprints is determined by comparing the position and information entropy feature fingerprints in the message feature operation. The matching is determined by setting a threshold for fingerprint similarity. If the fingerprint similarity is greater than the preset threshold, the message is considered to be matched successfully; if the fingerprint similarity is less than the preset threshold, the message is considered to be matched unsuccessfully.

4. A computer-readable storage medium, characterized in that, The computer-readable storage medium contains one or more program instructions, which are executed by a processor as described in any one of claims 1-3, for message recognition using a location-sensitive entropy fingerprint.

Images