Device fingerprint generation method and device

Abstract

The present invention discloses a device fingerprint generation method and device. A flow collection device is connected to at least one front-end device. The method includes: dividing a data stream into a plurality of data block sets; determining a target metric value corresponding to each data feature in each data block set based on the data features of each group in each data block, a similarity measurement function, and a preset character level; performing a cross-entropy operation on the target metric value to quantify the information value of each data feature for distinguishing each front-end device, and performing a mean calculation on the target metric value to quantify the stability of each data feature in data transmission; and comprehensively quantizing the quantized value to obtain a comprehensive vector; setting a preset threshold to screen data features that are easy to distinguish different devices and have high stability in data transmission, encoding the data features that meet the requirements to generate a device fingerprint, and uploading it to a device fingerprint library to facilitate tracing during fingerprint identification, thereby improving the security of data flow.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a device fingerprint generation method and device. Background Art

[0002] In the data industry, data concentration is very low due to the decentralized nature of data producers. To fully utilize data from multiple sources, source data is typically transmitted across multiple networks. This poses a security risk, as data may pass through malicious user devices during transmission, posing security threats such as eavesdropping, illegal tampering, resource hijacking, data leakage, and identity forgery.

[0003] In order to trace data transmission leaks, the tracing method during the data transmission process is generally achieved through traffic analysis. The data packets are analyzed to obtain the Internet Protocol address of the sender. However, the Internet Protocol identifier can be changed or manipulated by using expert knowledge of the network or software. This may cause major security threats when device identification plays a key security role. A reasonable mechanism is needed to solve the problems caused by such situations.

[0004] Therefore, how to improve the security of data flow is an urgent problem to be solved. Summary of the Invention

[0005] The present invention provides a device fingerprint generation method and device to solve the problem of low data flow security.

[0006] The present invention comprises:

[0007] In a first aspect, an embodiment of the present invention provides a device fingerprint generation method, which is applied to a traffic collection device connected to at least one front-end device. The method includes:

[0008] Dividing the collected data stream of the front-end device into a plurality of data block sets; wherein each data block set includes a plurality of data blocks, each data block includes a first preset number of groups, and each group contains a data feature;

[0009] Determining a target metric value corresponding to each data feature in each data block set based on the data features of each group within each data block, a preset similarity measurement function, and a preset character level; wherein the data block set includes a second preset number of data blocks;

[0010] Performing a cross entropy operation on the target metric value to obtain a first vector corresponding to each data feature; and performing a mean calculation on the target metric value to obtain a second vector corresponding to each data feature; wherein the first vector represents the information value of each data feature for distinguishing each front-end device; and the second vector represents the stability of each data feature during data transmission;

[0011] Determine a comprehensive vector corresponding to each data feature based on the first vector and the second vector;

[0012] The data features of the comprehensive vector that are higher than a preset threshold are encoded to generate a device fingerprint, and the device fingerprint and the front-end device information corresponding to the device fingerprint are uploaded to a preset device fingerprint library.

[0013] For different types of data features, their value for distinguishing different front-end devices is quantified to obtain a first vector. For example, if type A data features are suitable for distinguishing different front-end devices, while type B data features are not suitable for distinguishing different front-end devices, then the vector value of the first vector corresponding to type A data features is greater than the vector value of the first vector corresponding to type B data features.

[0014] For different types of data features, their stability in data transmission is quantified to obtain a second vector. For example, type A data features have higher stability in data transmission, while type B data features have lower stability in data transmission. Then, the vector value of the second vector corresponding to type A data features is greater than the vector value of the second vector corresponding to type B data features.

[0015] Based on the above technical solution, the information value of the front-end device and the stability during data transmission are distinguished by quantifying each data feature, and the data features that are easy to distinguish different devices and have high stability during data transmission are screened by setting preset thresholds. The data features that meet the requirements are combined and encoded to generate device fingerprints, which are uploaded to the preset device fingerprint library for comparison during fingerprint recognition.

[0016] First, the device fingerprint is generated using a feature extraction method based on data streams, which makes it difficult to forge fingerprint features. Even if the device address moves from one network to another, the device fingerprint generation method disclosed in this solution can remain stable and resist vulnerabilities such as node forgery or masquerade in the network, thereby improving the security of data flow.

[0017] Secondly, when transmitting encrypted data, the processing power of the device must be retained, so the computing power available for data encryption is limited. The device fingerprint generation method disclosed in this solution is simple and can trace data flow without frequent encryption and decryption operations;

[0018] Thirdly, this solution uses a more secure method to identify devices. Instead of using traditional identifiers such as Internet Protocol (IP) addresses or Media Access Control (MAC) addresses, this solution uses traffic collection devices, such as gateways, to identify data flows. Furthermore, in practical applications, the flow path can be displayed through the control center. This allows for real-time monitoring and tracing of data flows during the process, rather than simply tracing sensitive data flows after the fact. This further improves the security of data flows.

[0019] In one possible implementation, the data block is generated by the following method:

[0020] Dividing the data stream to obtain a plurality of sub-data streams including a first preset number of packets;

[0021] The data features of each group in each sub-data stream are encoded to generate the data block.

[0022] In one possible implementation, determining the target metric value corresponding to each data feature in each data block set based on the data features of each group in each data block, a preset similarity metric function, and a preset character level includes:

[0023] Calculating the data features of each data block based on the similarity measurement function to obtain a first measurement value; wherein the first measurement value is a measurement value corresponding to each data feature in each data block;

[0024] Determining a first metric value that meets the preset character level as a second metric value;

[0025] A plurality of second metric values ​​corresponding to each data feature in the data block set are encoded to obtain the target metric value.

[0026] In a possible implementation, performing mean calculation on the target metric values ​​to obtain the second vector corresponding to each data feature includes:

[0027] Summing multiple target metric values ​​corresponding to the same data feature in multiple data block sets to obtain a total metric value corresponding to the same data feature;

[0028] A mean calculation is performed based on the number of the data block sets and the total metric value corresponding to the same data feature to obtain a second vector corresponding to the same data feature.

[0029] In one possible implementation, after generating the device fingerprint, the method includes:

[0030] Performing spread spectrum on the communication channel of each front-end device;

[0031] The device fingerprint corresponding to each front-end device is encoded, and a watermark bit corresponding to each front-end device is generated respectively, and the watermark bit is embedded in the data stream output by the front-end device corresponding to the watermark bit.

[0032] In practical applications, a rate-based stream watermark embedding method can be used to resist the attacker's destruction of the robustness of the watermark algorithm and the detector's ability to identify the watermark when the attacker changes the statistical characteristics based on the traffic content, making the traceability data more secure.

[0033] In a possible implementation, before encoding the device fingerprint corresponding to each front-end device and generating the watermark bit corresponding to each front-end device, the method further includes:

[0034] Filter the collected data stream according to the preset sensitive data information table to obtain the target data stream;

[0035] The step of embedding each watermark bit into a data stream output by a front-end device corresponding to each watermark bit includes:

[0036] Each watermark bit is embedded in the target data stream output by the front-end device corresponding to each watermark bit.

[0037] In practical applications, bits can be embedded in the data stream to mark whether it is a data stream about sensitive data. Specifically, it is only necessary to perform sensitive data association analysis at the source, and use the identification bit to monitor and compare the flow during the flow, which improves the recognition efficiency and is very suitable for expansion in low-energy IoT devices.

[0038] In a possible implementation, after embedding each watermark bit into the data stream output by the front-end device corresponding to each watermark bit, the method further includes:

[0039] Extracting the watermark bits from the data stream to be identified and decoding the watermark bits to obtain the fingerprint to be identified;

[0040] Identify the fingerprint to be identified based on the device fingerprint in the device fingerprint library to obtain front-end device information corresponding to the data stream to be identified;

[0041] The front-end device information corresponding to the data flow to be identified is uploaded to the preset data flow record library.

[0042] In a second aspect, an embodiment of the present invention provides a traffic collection device, which includes a watermark generator, a watermark embedder, a watermark extractor, and a watermark detector. The traffic collection device is used to implement any method described in the first aspect.

[0043] This solution also improves the composition of traffic collection equipment. General traffic collection equipment, such as gateways, does not include the above-mentioned watermark generator, watermark embedder, watermark extractor and watermark detector. This solution can add watermark embedders and watermark detectors to the entry and exit gateways. The device fingerprint is converted into a watermark code with specific properties at the watermark embedder and embedded in the data stream. The characteristics of the traffic are analyzed at the watermark detector to detect the watermarked stream and decode the watermark, thereby achieving the tracking function of data multi-gateway flow under MAC tampering attacks and IP spoofing attacks. It can also realize real-time and periodic data traceability audits, and achieve full visibility of sensitive data throughout the entire cycle.

[0044] In a third aspect, an embodiment of the present invention provides an electronic device comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor implements the steps of any one of the methods described in the first aspect by running the executable instructions.

[0045] In a fourth aspect, an embodiment of the present invention provides a computer-readable and writable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of any one of the methods described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0047] Figure 1 A schematic diagram of a process for generating a device fingerprint according to an embodiment of the present invention;

[0048] Figure 2 A schematic diagram of a specific process of a device fingerprint generation method provided by an embodiment of the present invention;

[0049] Figure 3 A schematic structural diagram of a flow collection device provided by an embodiment of the present invention;

[0050] Figure 4 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] To make the objectives, technical solutions, and advantages of the present invention more apparent, the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the embodiments described herein are merely some, rather than all, of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0052] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but rather merely represents selected embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort shall fall within the scope of protection of the present invention.

[0053] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0054] In the description of the present invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer" and the like indicate positions or locations based on the positions shown in the accompanying drawings, or the positions or locations in which the inventive product is typically placed when in use. These terms are intended solely to facilitate the description of the present invention and to simplify the description, and are not intended to indicate or imply that the devices or components referred to must have a specific orientation, be constructed, or operate in a specific orientation. Therefore, they should not be construed as limitations on the present invention. Furthermore, the terms "first," "second," and "third," etc., are used solely to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0055] In the description of the present invention, it should also be noted that, unless otherwise expressly specified or limited, the terms "disposed," "installed," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed connections, detachable connections, or integral connections; they may refer to mechanical connections or electrical connections; they may refer to direct connections or indirect connections through an intermediate medium; and they may refer to internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on the specific circumstances.

[0056] In current traffic analysis, the statistical characteristics of the flow data packets, such as packet length, packet spacing, and packet direction, are generally analyzed, and advanced machine learning algorithms are used to predict user locations and detect abnormal traffic. However, the tracing method during the data transmission process is generally achieved through traffic analysis. The data packets are analyzed to obtain the Internet Protocol address of the sender. However, the Internet Protocol identifier can be changed or manipulated by using expert knowledge of the network or software. This may cause major security threats in cases where device identification plays a key security role. A reasonable mechanism is needed to solve the problems caused by such situations and further improve the security of data flow.

[0057] In view of the above problems, embodiments of the present invention provide a device fingerprint generation method and device to solve the problem of low security during data transfer.

[0058] The following describes the device fingerprint generation method provided by the exemplary embodiment of the present application in combination with the application scenarios described above and with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this respect.

[0059] like Figure 1 FIG. 1 is a flow chart of a device fingerprint generation method according to an embodiment of the present invention. The method is applied to a traffic collection device connected to at least one front-end device. The method includes:

[0060] Step 101: Divide the collected data stream of the front-end device into multiple data block sets.

[0061] It should be noted that each data block set includes multiple data blocks, each data block includes a first preset number of groups, and each group contains a data feature.

[0062] In addition, a packet is a binary format unit transmitted in the network. In order to improve communication performance and reliability, the data sent by each user will be divided into multiple smaller parts. A header and a tail consisting of control information are added in front of each part to form a packet.

[0063] Step 102 : determining a target metric value corresponding to each data feature in each data block set based on the data features of each group in each data block, a preset similarity metric function, and a preset character level.

[0064] It should be noted that the data block set includes a second preset number of data blocks.

[0065] Step 103: perform a cross entropy operation on the target metric value to obtain a first vector corresponding to each data feature; and perform a mean calculation on the target metric value to obtain a second vector corresponding to each data feature.

[0066] It should be noted that the first vector represents each data feature and is used to distinguish the information value of each front-end device; the second vector represents the stability of each data feature during data transmission;

[0067] Step 104: Determine a comprehensive vector corresponding to each data feature based on the first vector and the second vector.

[0068] Step 105 , encode the data features whose comprehensive vectors are higher than a preset threshold, generate a device fingerprint, and upload the device fingerprint and the front-end device information corresponding to the device fingerprint to a preset device fingerprint library.

[0069] The following describes the device fingerprint generation method in detail with reference to an embodiment:

[0070] Figure 2 A schematic diagram of a specific process of generating a device fingerprint according to an embodiment of the present application is shown as follows: Figure 2 As shown, the method includes:

[0071] Step 201: collect and analyze the data flow of the front-end device.

[0072] In a possible embodiment, traffic collection and analysis refers to passively capturing all types of network traffic on the access gateway. Traffic collection and analysis may include pre-filtering and data feature extraction, wherein pre-filtering refers to filtering out unusable data streams.

[0073] In addition, the device fingerprint is generated using a feature extraction method based on data streams, which makes it difficult to forge fingerprint features. Even if the device address moves from one network to another, the device fingerprint generation method disclosed in this solution can remain stable and resist vulnerabilities such as node forgery or disguise in the network, thereby improving the security of data flow.

[0074] Step 202: Divide the collected data stream of the front-end device into multiple data block sets.

[0075] In a possible embodiment, the data block may be generated by the following method:

[0076] The data stream is divided to obtain a plurality of sub-data streams including a first preset number of groups, and data features of each group in each sub-data stream are encoded to generate data blocks.

[0077] Step 203 : Based on the data features of each group in each data block, a preset similarity measurement function and a preset character level, a target measurement value corresponding to each data feature in each data block set is determined.

[0078] In a possible embodiment, the target metric value may be determined by the following method:

[0079] First, the data features of each data block are calculated based on the similarity measurement function to obtain a first measurement value.

[0080] It should be noted that the first metric value is a metric value corresponding to each data feature in each data block.

[0081] Then, the first metric value that meets the preset character level is determined as the second metric value.

[0082] Finally, multiple second metric values ​​corresponding to each data feature in the data block set are encoded to obtain a target metric value.

[0083] Step 204: Perform a cross entropy operation on the target metric value to obtain a first vector corresponding to each data feature.

[0084] Specifically, the variability of features can be evaluated based on the metric entropy values ​​of data features calculated from different front-end devices. For example, the entropy value of the feature metric is calculated based on the metric centroid values ​​of multiple cascaded blocks. Therefore, for different types of data features, they can be used to distinguish the value of different front-end devices and quantify them to obtain a first vector.

[0085] For example, type A data features are applicable to distinguishing different front-end devices, while type B data features are not applicable to distinguishing different front-end devices. Then, the vector value of the first vector corresponding to type A data features is greater than the vector value of the first vector corresponding to type B data features.

[0086] In step 205 , the target metric value is averaged to obtain a second vector corresponding to each data feature.

[0087] In a possible embodiment, the second vector may be calculated by the following method:

[0088] First, multiple target metric values ​​corresponding to the same data feature in multiple data block sets are summed to obtain the total metric value corresponding to the same data feature.

[0089] Then, the mean is calculated based on the number of data block sets and the total value of the metric corresponding to the same data feature to obtain a second vector corresponding to the same data feature.

[0090] Specifically, for different types of data features, their stability in data transmission is quantified to obtain a second vector. For example, type A data features have higher stability in data transmission, while type B data features have lower stability in data transmission. Then, the vector value of the second vector corresponding to type A data features is greater than the vector value of the second vector corresponding to type B data features.

[0091] Step 206: Determine a comprehensive vector corresponding to each data feature based on the first vector and the second vector.

[0092] In a possible embodiment, the two vectors can be combined by using a multiplication operation to obtain a comprehensive vector corresponding to each data feature, and the comprehensive vector can represent the information value of the feature in distinguishing different devices and the stability in data transmission.

[0093] Step 207 : Encode the data features whose comprehensive vectors are higher than a preset threshold value to generate a device fingerprint, and upload the device fingerprint and the front-end device information corresponding to the device fingerprint to a preset device fingerprint library.

[0094] The device fingerprint generation method disclosed in this application distinguishes the information value of the front-end device and the stability during data transmission by quantifying each data feature, and screens data features that are easy to distinguish different devices and have high stability during data transmission by setting a preset threshold, and combines and encodes the data features that meet the requirements to generate device fingerprints, which are uploaded to a preset device fingerprint library for comparison during fingerprint recognition.

[0095] When transmitting encrypted data, the processing power of the device must be retained, so the computing power that can be called upon for data encryption is limited. The device fingerprint generation method disclosed in this solution is simple and can trace data flow without frequent encryption and decryption operations.

[0096] Furthermore, after generating the device fingerprint, the device fingerprint needs to be embedded, such as Figure 3 As shown, the embedding methods include:

[0097] Step 208: Filter the collected data stream according to the preset sensitive data information table to obtain the target data stream.

[0098] In a possible embodiment, flows involving sensitive data may be selected for embedding, and flows not involving sensitive data may be directly sent to the network.

[0099] Step 209: Perform spectrum spreading on the communication channel of each front-end device.

[0100] Like all communication channels, the channel carrying the watermark bits may also be noisy, and interference added to the carrier signal may destroy the watermark, so it is necessary to improve the robustness of the watermark system and the reliability of the embedded watermark.

[0101] In one possible embodiment, time-based spreading can be performed. For example, when a single bit b is replicated multiple times using the same version of the carrier signal, a sparsification method is used to map the single bit b to a long sequence of M bits, and further spreading is performed by controlling the signal carrier size.

[0102] In one possible embodiment, when direct spreading is involved, frequency-based spreading such as using a pseudo-noise code may be used to spread a carrier signal over a frequency spectrum wider than the original signal bandwidth.

[0103] Step 210: Encode the device fingerprint corresponding to each front-end device and generate a watermark bit corresponding to each front-end device.

[0104] In a possible embodiment, when the egress gateway sends a sensitive data stream to the network, it can be mapped into two identifiers b0 and b1 based on whether the data stream carries a device fingerprint code. For example, if the received data stream contains a device fingerprint, identifier b0 is generated and embedded in the data stream; if the received data stream does not contain a device fingerprint, identifier b1 is generated and embedded in the data stream.

[0105] The above method can optimize the embedding process of device fingerprints, and further determine whether fingerprint extraction is needed through identifiers. In addition, this solution does not use traditional identifiers such as Internet Protocol (IP) addresses or Media Access Control (MAC) addresses, but uses traffic collection devices to identify data flows. The flow path can be further displayed through the control center, thereby realizing real-time monitoring and tracing of data flow, further improving the security of data flow.

[0106] Step 211: embed each watermark bit into the data stream output by the front-end device corresponding to each watermark bit.

[0107] In one possible embodiment, watermark bits can be embedded into the target data stream by modifying certain characteristics of the carrier signal. For example, a rate-based approach can be used: injecting virtual traffic into a certain segment of the network to influence the rate of the actual traffic passing through the same segment at the time. By controlling the traffic injection, a recognizable rate pattern is generated on the target stream, and a watermark bit rate sequence is embedded in the target stream.

[0108] Through the above method, the data stream is regarded as a duplex ordered message sequence sent from the source to the destination and flowing through the network, in which information can be transmitted bidirectionally at the same time. The device fingerprint is actively embedded in the data stream as a watermark, which is then used to trace the data source.

[0109] Additionally, messages generated by sources at the application layer can be segmented and aggregated and encrypted before being encapsulated in an Internet protocol packet stream according to the Internet protocol suite, making it impossible to read the messages at the application layer due to encryption, thus enabling watermark embedding at the network layer.

[0110] Furthermore, after embedding the device fingerprint, it is necessary to perform a detection operation on the device fingerprint, such as Figure 3 As shown, the detection method includes:

[0111] Step 212: extract the watermark bits from the data stream to be identified, and decode the watermark bits to obtain the fingerprint to be identified.

[0112] In one possible embodiment, when traffic enters the traffic collection device, the watermark extractor can extract packet features that may transmit watermark bits based on configured carrier features. The selected carrier features can be the descriptor vector of the data stream to be identified and the arrival timestamp of the extracted packet.

[0113] Furthermore, after extracting the features, the identifier calculates the function value of the extracted features and the parameters previously arranged with the watermark. This value can indicate whether the currently detected stream has a watermark. At the same time, the stream packet features are decoded to extract the fingerprint to be identified.

[0114] Step 213: Identify the fingerprint to be identified based on the device fingerprint in the device fingerprint library to obtain the front-end device information corresponding to the data flow to be identified.

[0115] In a possible embodiment, the fingerprint to be identified may be compared with the device fingerprints in the device fingerprint library, and a device tag containing corresponding front-end device information may be assigned to the data stream containing the matching fingerprint to be identified.

[0116] Step 214: Upload the front-end device information corresponding to the data flow to be identified to a preset data flow record library.

[0117] In a possible embodiment, the data upload service can be enabled at the gateway at the same time, and the identified front-end device information and data flow records can be uploaded to the preset data flow record library. The transit platform will promptly display the key devices through which sensitive data flows, and further, the data flow can be traced.

[0118] In summary, the device fingerprint generation method disclosed in the present application distinguishes the information value of the front-end device and the stability during data transmission by quantifying each data feature, and screens data features that are easy to distinguish different devices and have high stability during data transmission by setting preset thresholds, and combines and encodes the data features that meet the requirements to generate device fingerprints. The device fingerprint generation and detection method disclosed in this scheme is simple and does not require frequent encryption and decryption operations to trace data flow, making it convenient for the device to call more computing power to process other information. In addition, during the data flow process, the embedded watermark bit is used to monitor and compare the flow, which improves the recognition efficiency, making this method suitable for application in low-energy IoT devices. Finally, this scheme can realize real-time and periodic data traceability audits, and achieve full visibility of sensitive data throughout the entire cycle, so that technicians can directly locate the local gateway, which helps to track the flow from the source to the attacker, identify the threat party, locate and block it in time, and ultimately make reactive decisions about it.

[0119] For example, when a front-end device is infected by malware developed, managed, and coordinated by a single entity, such as a bot host. Depending on the attacker's intentions, the bot can be exploited to perform different illegal behaviors, such as distributed denial of service (DDoS) attacks, spam, and phishing, and can be considered a specific type of network-based attack. Like any other type of network-based attacker, the device owner wants to remain unknown. The device fingerprint watermarking in this scheme can be extended to the distributed architecture of the botnet to locate and neutralize the strategies of zombie devices and device owners.

[0120] For example, the modular organization of current network services provides functionality, security, and reliability, but when misbehavior occurs, it is difficult to isolate the root cause of the problem. The relationships between services available on the Internet, such as the Domain Name System (DNS), Internet servers, and load balancing, and the infrastructure that supports these services are becoming increasingly complex. Therefore, this solution can be used to detect dependencies between interacting application services by using stream watermarks and device fingerprinting to identify dependencies between network services in complex platforms.

[0121] Based on the same technical concept, the embodiment of the present application also provides a flow collection device, such as Figure 3 As shown, the traffic collection device includes a watermark generator 301, a watermark embedder 302, a watermark extractor 303 and a watermark detector 304. The traffic collection device is used to implement the following Figure 2 Any of the methods in .

[0122] Traditional device fingerprint identification methods are usually performed through the Internet of Things server. For example, the Internet of Things server pre-processes the network traffic received from the Internet of Things gateway; the Internet of Things server captures the pre-processed network traffic in multiple capture periods, and determines the target capture period among the multiple capture periods, determines the target physical address of the target Internet of Things device from the network traffic captured during the target capture period, and then extracts the device fingerprint of the target Internet of Things device based on the target physical address, and identifies the device fingerprint.

[0123] In this solution, feature extraction, device fingerprint generation, embedding, and detection of data streams are all completed in traffic collection devices, such as gateways. Compared with the above-mentioned solution of using IoT servers for fingerprint recognition, even if the device address moves from one network to another, the device fingerprint generation method disclosed in this solution can remain stable and resist vulnerabilities such as node forgery or masquerade in the network, thereby improving the security of data flow.

[0124] In addition, general traffic collection devices, such as gateways, do not include the above-mentioned watermark generators, watermark embedders, watermark extractors and watermark detectors. This solution can add watermark embedders and watermark detectors to the entry and exit gateways. The device fingerprint is converted into a watermark code with specific properties at the watermark embedder and embedded in the data stream. The characteristics of the traffic are analyzed at the watermark detector to detect the watermarked stream and decode the watermark, thereby achieving the tracking function in the multi-gateway flow of data under MAC tampering attacks and IP spoofing attacks. It can also achieve real-time and periodic data traceability audits, and fully visualize sensitive data throughout the entire cycle, so that technicians can directly locate the local gateway, which helps to track the traffic from the source to the attacker, identify the threat party, locate and block it in time, and ultimately make reactive decisions about it.

[0125] Based on the same technical concept, the embodiment of the present application also provides an electronic device, such as Figure 4 As shown, it includes: a processor 401 and a memory 402 for storing processor executable instructions; wherein the processor 401 executes the executable instructions to implement the following Figure 2 Any of the methods in .

[0126] Exemplarily, the processor 401 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0127] It should be understood that the memory 402 mentioned in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0128] It should be noted that when the processor 401 is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0129] It should be noted that the memory described herein is intended to include, but not be limited to, these and any other suitable types of memory.

[0130] Based on the same technical concept, the embodiment of the present application also provides a computer storage medium, including a program or instruction, which, when the program or instruction is run on a computer, enables the following Figure 2 Any of the methods in are executed.

[0131] It should be understood that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0132] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0133] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0134] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0135] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0136] Obviously, those skilled in the art may make various modifications and variations to this application without departing from the scope of protection of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A device fingerprint generation method, characterized in that: Applied to a traffic collection device, the traffic collection device is connected to at least one front-end device, and the method includes: Dividing the collected data stream of the front-end device into a plurality of data block sets; wherein each data block set includes a plurality of data blocks, each data block includes a first preset number of groups, and each group contains a data feature; Determining a target metric value corresponding to each data feature in each data block set based on the data features of each group within each data block, a preset similarity measurement function, and a preset character level; wherein the data block set includes a second preset number of data blocks; Performing a cross entropy operation on the target metric value to obtain a first vector corresponding to each data feature; and performing a mean calculation on the target metric value to obtain a second vector corresponding to each data feature; wherein the first vector represents the information value of each data feature for distinguishing each front-end device; and the second vector represents the stability of each data feature during data transmission; Determine a comprehensive vector corresponding to each data feature based on the first vector and the second vector; The data features of the comprehensive vector that are higher than a preset threshold are encoded to generate a device fingerprint, and the device fingerprint and the front-end device information corresponding to the device fingerprint are uploaded to a preset device fingerprint library.

2. The device fingerprint generation method according to claim 1, characterized in that: Generate a data block using the following method: Dividing the data stream to obtain a plurality of sub-data streams including a first preset number of packets; The data features of each group in each sub-data stream are encoded to generate the data block.

3. The device fingerprint generation method according to claim 1, wherein: The step of determining a target metric value corresponding to each data feature in each data block set based on the data features of each group in each data block, a preset similarity measurement function, and a preset character level includes: Calculating the data features of each data block based on the similarity measurement function to obtain a first measurement value; wherein the first measurement value is a measurement value corresponding to each data feature in each data block; Determining a first metric value that meets the preset character level as a second metric value; A plurality of second metric values ​​corresponding to each data feature in the data block set are encoded to obtain the target metric value.

4. The device fingerprint generation method according to claim 3, characterized in that: The performing mean calculation on the target metric value to obtain the second vector corresponding to each data feature includes: Summing multiple target metric values ​​corresponding to the same data feature in multiple data block sets to obtain a total metric value corresponding to the same data feature; A mean calculation is performed based on the number of the data block sets and the total metric value corresponding to the same data feature to obtain a second vector corresponding to the same data feature.

5. The device fingerprint generation method according to claim 1, wherein: After generating the device fingerprint, the method includes: Performing spread spectrum on the communication channel of each front-end device; The device fingerprint corresponding to each front-end device is encoded, and a watermark bit corresponding to each front-end device is generated respectively, and the watermark bit is embedded in the data stream output by the front-end device corresponding to the watermark bit.

6. The device fingerprint generation method according to claim 5, characterized in that: Before encoding the device fingerprint corresponding to each front-end device and generating the watermark bit corresponding to each front-end device, the method further includes: Filter the collected data stream according to the preset sensitive data information table to obtain the target data stream; The step of embedding each watermark bit into a data stream output by a front-end device corresponding to each watermark bit includes: Each watermark bit is embedded in the target data stream output by the front-end device corresponding to each watermark bit.

7. The device fingerprint generation method according to claim 5, characterized in that: After embedding each watermark bit into the data stream output by the front-end device corresponding to each watermark bit, the method further includes: Extracting the watermark bits from the data stream to be identified and decoding the watermark bits to obtain the fingerprint to be identified; Identify the fingerprint to be identified based on the device fingerprint in the device fingerprint library to obtain front-end device information corresponding to the data stream to be identified; The front-end device information corresponding to the data flow to be identified is uploaded to the preset data flow record library.

8. A flow collection device, characterized in that: The traffic collection device includes a watermark generator, a watermark embedder, a watermark extractor and a watermark detector, and the traffic collection device is used to implement the method according to any one of claims 1-7.

9. An electronic device, characterized in that: include: processor; A memory for storing processor-executable instructions; wherein the processor implements the steps of the method according to any one of claims 1 to 7 by running the executable instructions.

10. A computer readable and writable storage medium having computer instructions stored thereon, characterized in that: When the instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images