A method for creating a dynamically updated network device fingerprint library

Abstract

The application relates to a dynamic updating network device fingerprint library creation method, which comprises the following steps: acquiring the IP addresses and MAC addresses of all devices in a local area network and creating a corresponding device list; acquiring the fingerprint features of the devices; creating a network device fingerprint library and storing the IP addresses, MAC addresses and fingerprint features of all the devices in the network device fingerprint library; merging the same type of devices in the network device fingerprint library according to the fingerprint features of the devices, and distinguishing the known devices and unknown devices according to the existing network device fingerprint library; connecting the unknown devices through remote connection according to the IP addresses and MAC addresses of the devices, obtaining the operating system information of the unknown devices, updating the fingerprint features of the corresponding unknown devices in the network device fingerprint library, merging the same type of devices in the network device fingerprint library, completing the network device fingerprint library updating; confirming that the unknown devices in the device list are all updated into known devices through multiple scanning, and completing the network device fingerprint library creation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer networks, in particular to a method for creating a dynamically updated network device fingerprint library. BACKGROUND

[0002] Network device detection not only provides a system cognitive basis for network security monitoring and threat situation awareness, but also has more applications in improving the efficiency of intrusion detection systems, security threat analysis, etc. According to the operating system type version of network detection, timely operating system patch repair can be performed to enhance the security of the operating system. For network security managers, accurately mastering the operating system type and quantity of servers and PC machines in the managed network can also better identify network characteristics and configure network security strategies accordingly. For partitioned networks, abnormal device detection can effectively discover devices that have left the current network, such as devices originally running in the internal network appearing in the external network, and timely warning and network cutting measures can be taken to avoid information leakage.

[0003] In the prior art CN106487879A, a network device identification method and device based on a device fingerprint library, the device type, device brand and device model of the device to be detected are confirmed by comparing the known device fingerprint stored in the created device fingerprint library with the device fingerprint to be detected. The created device fingerprint library needs to be maintained and updated regularly. In the prior art CN106302397B, a device identification system based on device fingerprints, the fingerprint information of the device to be detected is confirmed by comparing the known device fingerprint stored in the created device fingerprint library with the device fingerprint to be detected. The unknown fingerprint information is transferred to manual identification, and the manually identified fingerprint information is stored in the fingerprint library. In the above two prior arts, regular updating of the database cannot solve the problem that when new devices appear, the fingerprint library cannot match the corresponding fingerprint characteristics and cannot identify new devices. Manual identification of unknown devices may have errors and low identification efficiency. SUMMARY

[0004] To solve the problems existing in the prior art, the present application provides a method for creating a dynamically updated network device fingerprint library.

[0005] The technical solution of the present application is as follows:

[0006] On the one hand, the present application provides a method for creating a dynamically updated network device fingerprint library, the specific steps of which are as follows:

[0007] Traffic monitoring is performed at the mirror port of the core switching device of the local area network, the IP addresses and MAC addresses of all devices in the local area network are obtained, and a corresponding device list is created;

[0008] starting a full scan on all devices in the device list, obtaining the fingerprint features of each device; creating a network device fingerprint library and storing the IP addresses, MAC addresses and fingerprint features of all devices in the network device fingerprint library;

[0009] merging the same type of devices in the network device fingerprint library according to the fingerprint features of each device, and distinguishing known devices and unknown devices according to the existing network device fingerprint library;

[0010] connecting the unknown devices through remote connection according to the IP addresses and MAC addresses of the devices, obtaining the operating system information of the unknown devices and updating the fingerprint features of the corresponding unknown devices in the network device fingerprint library, merging the same type of devices in the network device fingerprint library, and completing the update of the network device fingerprint library;

[0011] Confirming that the unknown devices in the device list are all updated to known devices through multiple scans, and the network device fingerprint library is created.

[0012] As a preferred embodiment, the specific steps of creating a network device fingerprint library and storing the IP addresses, MAC addresses and fingerprint features of all devices in the network device fingerprint library are as follows:

[0013] Converting the fingerprint features of each device into readable data exchange files through scanning and parsing software at the network connection end of each device, and obtaining a feature matching table, wherein the feature matching table contains operating system name and version information; and then storing the fingerprint features of each device, the readable data exchange files corresponding to the fingerprint features, the IP addresses and the MAC addresses in the network device fingerprint library.

[0014] As a preferred embodiment, the specific operation steps of merging the same type of devices in the network device fingerprint library according to the fingerprint features of each device, and distinguishing known devices and unknown devices according to the existing network device fingerprint are as follows:

[0015] According to the operating system name and version information of each device as a classification standard, the same type of devices are merged, and then the device fingerprints corresponding to the merged various types of devices are compared with the existing network device fingerprint library to confirm the device model, according to the matching result, all devices are classified, the known devices are marked with the device model, and the devices that cannot be matched are marked as unknown devices.

[0016] As a preferred embodiment, it further includes the update steps of the network device fingerprint library when a new device is connected to the network:

[0017] Scanning the new device to obtain the IP address and MAC address and storing them in the created to-be-scanned device list;

[0018] The list of to-be-scanned devices is compared with the IP addresses and MAC addresses in the original device list in the database to determine whether it is a new device, and the result of the determination is that the known device is excluded from the list of to-be-scanned devices;

[0019] The new devices in the list of to-be-scanned devices are subjected to full scanning to obtain the fingerprint features of each new device, and then the fingerprint features of each new device are compared with the fingerprint features in the network device fingerprint library, and the matched ones are merged into the known device type and added to the device list of the known device;

[0020] The new devices that are not matched are started for fuzzy matching, the fuzzy matching is to compare the user end name, operating system feature and open port feature of the new device, and generate the corresponding fingerprint feature; then a fingerprint name is defined for the new device, and the corresponding fingerprint feature, IP address and MAC address are added to the network device fingerprint library to generate a new device type, and the device name is updated into the device list of the known device, and the network device fingerprint library is updated.

[0021] On the other hand, the application also proposes a dynamically updated network device fingerprint storage system, comprising:

[0022] The device address acquisition module: implements traffic monitoring at the mirror port of the local area network core switching device, obtains the IP addresses and MAC addresses of all devices in the local area network, and creates a corresponding device list;

[0023] The fingerprint feature acquisition module: starts full scanning on all devices in the device list to obtain the fingerprint features of each device;

[0024] The fingerprint feature analysis module: merges the same type of devices in the network device fingerprint library according to the fingerprint features of each device, and distinguishes the known devices and unknown devices according to the existing network device fingerprint library;

[0025] The network device fingerprint library updating module: connects the unknown device through remote connection according to the IP address and MAC address of the device, obtains the operating system information of the unknown device, updates the fingerprint features of the corresponding unknown device in the network device fingerprint library, merges the same type of devices in the network device fingerprint library, and completes the updating of the network device fingerprint library.

[0026] As a preferred embodiment, the specific steps of creating the network device fingerprint library and storing the IP addresses, MAC addresses and fingerprint features of all devices in the network device fingerprint library are as follows:

[0027] The fingerprint features of each device are converted into readable data exchange files by scanning and analyzing software at the network connection end of each device, and a feature matching table is obtained, wherein the feature matching table contains operating system name and version information; and the fingerprint features of each device, the readable data exchange files corresponding to the fingerprint features, IP addresses and MAC addresses are stored in the network device fingerprint library.

[0028] As a preferred embodiment, the specific operation steps of merging the same type of devices in the network device fingerprint library according to the fingerprint features of each device and distinguishing known devices and unknown devices according to existing network device fingerprints are as follows:

[0029] According to the operating system name and version information of each device as a classification standard, the same type of devices is merged, and the device fingerprints corresponding to the merged various types of devices are compared with the existing network device fingerprint library to confirm the device model. According to the matching result, all devices are classified, known devices are marked with the device model, and devices that cannot be matched are marked as unknown devices.

[0030] As a preferred embodiment, the network device fingerprint library update steps when a new device is connected to the network are as follows:

[0031] The IP address and MAC address of the new device are scanned and stored in the created to-be-scanned device list;

[0032] The to-be-scanned device list is compared with the IP address and MAC address in the original device list in the database to determine whether it is a new device. If the result is a known device, the to-be-scanned device list is removed;

[0033] The new device in the to-be-scanned device list is fully scanned to obtain the fingerprint features of each new device, and the fingerprint features of each new device are compared with the fingerprint features in the network device fingerprint library. The matched ones are merged into the known device type and added to the device list of the known device;

[0034] The new device that fails to match is started for fuzzy matching. The fuzzy matching is to compare the user end name, operating system feature and open port feature of the new device, and generate corresponding fingerprint features. Then a fingerprint name is defined for the new device, and the corresponding fingerprint features, IP address and MAC address are added to the network device fingerprint library to generate a new device type, and the device name is updated into the device list of the known device. The network device fingerprint library is updated.

[0035] On the other hand, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method for creating a dynamically updated network device fingerprint library according to any embodiment of the present invention is implemented.

[0036] In another aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for creating a dynamically updated network device fingerprint database according to any embodiment of the present invention.

[0037] The present invention has the following beneficial effects:

[0038] 1. It can support the collection and analysis of device fingerprint features, IP addresses and MAC addresses in large-scale network environments, ensuring the integrity of device fingerprint features contained in the network device fingerprint library and the efficiency of fingerprint collection.

[0039] 2. The network device fingerprint library has a dynamic update function. When the network device fingerprint library identifies an unknown device, it can use the known IP address and MAC address to connect to the unknown device through remote control, and then obtain the device's operating system information and other fingerprint features on the host of the unknown device. The obtained device fingerprint features are then used to update the existing network device fingerprint library. The dynamic update function replaces the previous manual function, more efficiently and accurately identifying unknown devices and completing the update of the fingerprint library.

[0040] 3. The dynamic update function of the network device fingerprint library is also reflected in the fact that it can quickly respond and identify the type of new devices after a new device joins the network; if the data is successfully compared with the existing fingerprint library, the type of device can be directly confirmed. If the corresponding data cannot be identified in the existing fingerprint library, the fingerprint library can be quickly updated to add the new device type to the fingerprint library to complete the fingerprint library update process.

[0041] 4. The present invention also adopts fuzzy comparison technology to identify obfuscated encryption devices, ensuring the security of the local area network and the efficiency of updating the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 Schematic diagram of the method flow of embodiment 1 of the present invention. DETAILED DESCRIPTION

[0043] With reference to the drawings and the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative efforts belong to the scope of the present application.

[0044] It should be understood that the step numbers used herein are only for the convenience of description, and are not limited to the execution sequence of the steps.

[0045] It should be understood that the terms used in the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the present application and the appended claims, unless otherwise clear from context, the singular forms "a", "an" and "the" are intended to include plural forms.

[0046] The terms "comprise" and "include" indicate the presence of the described features, integers, steps, operations, elements, and / or components, but do not exclude one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0047] The term "and / or" means any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0048] Embodiment one:

[0049] Referring to Figure 1 A dynamic updating network device fingerprint library creation method, the specific steps are:

[0050] Implementing traffic monitoring at the mirror port of the local area network core switching device, obtaining the IP addresses and MAC addresses of all devices in the local area network and creating a corresponding device list;

[0051] In specific implementation, the location of each device host can be quickly determined according to the obtained IP addresses and MAC addresses of each device.

[0052] Starting full scan on all devices in the device list to obtain the fingerprint characteristics of each device; creating a network device fingerprint library and storing the IP addresses, MAC addresses and fingerprint characteristics of all devices in the network device fingerprint library;

[0053] In specific implementation, at this step, the private fingerprint library is started to be established, and the fingerprint library model can be initially established by obtaining the fingerprint characteristics of all devices, but each device is a type, and the merging between devices of the same type is still needed.

[0054] According to the fingerprint features of each device, the same type of devices in the network device fingerprint library is merged, and the known devices and unknown devices are distinguished according to the existing network device fingerprint library;

[0055] In the implementation, the same type of devices is merged according to the fingerprint features of each device, and the models and information of various types of devices are matched according to the known device fingerprint library, and the devices that cannot be matched are identified as unknown devices.

[0056] The unknown device is connected remotely according to the IP address and MAC address of the device, the operating system information of the unknown device is obtained, the fingerprint features of the corresponding unknown device in the network device fingerprint library are updated, the same type of devices in the network device fingerprint library is merged, and the network device fingerprint library is updated;

[0057] In the actual operation of the embodiment, the control right is obtained by remotely connecting to the unknown device, the operating system information is obtained by inputting cat / proc / os_info, the fingerprint features of the corresponding device in the network device fingerprint library are updated through the operating system information, and the updated fingerprint features need to be compared with the fingerprint features of other types of devices in the network device fingerprint library again to confirm whether the same type of devices matching the updated fingerprint features exist. If they exist, the same type of devices is merged, and if they do not exist, the network device fingerprint library is added, a new device type is created, and the fingerprint library is updated.

[0058] The unknown devices in the device list are updated to known devices through multiple scans, and the network device fingerprint library is created.

[0059] As a preferred embodiment of the embodiment, the specific steps of creating the network device fingerprint library and storing the IP address, MAC address and fingerprint features of all devices in the network device fingerprint library are as follows:

[0060] The fingerprint features of each device are converted into readable data exchange files by scanning and parsing software at the network connection end of each device, and a feature matching table is obtained, wherein the feature matching table contains operating system name and version information; and the fingerprint features of each device, the readable data exchange files corresponding to the fingerprint features, the IP address and the MAC address are stored in the network device fingerprint library.

[0061] In the actual operation of the embodiment, the nmap fingerprint features are obtained by full scanning at the network connection end, and the fingerprint features of the device are converted into JSON files by the nmap parser to obtain the matches matching table, which contains operating system name and version information; and then the IP address, MAC address, JSON files corresponding to the fingerprint features of each device and the matches matching table are added to the created network device fingerprint library as basic data.

[0062] As a preferred implementation of this embodiment, the specific operation steps of merging the same type of devices in the network device fingerprint library according to the fingerprint characteristics of each device and distinguishing known devices from unknown devices based on the existing network device fingerprints are as follows:

[0063] Based on the operating system name and version information of each device as the classification standard, devices of the same type are merged, and then the device fingerprints corresponding to the merged various types of devices are compared with the existing network device fingerprint library to confirm the device model. All devices are classified according to the matching results. Known devices are marked with the device model, and devices that cannot be matched are marked as unknown devices.

[0064] In the actual operation of this embodiment, the operating system name and version information in the above-mentioned matches table are used as classification criteria to classify each device, merge devices of the same type, and then match with the fingerprint library officially provided by nmap to confirm the model of each device. Devices that cannot be confirmed are marked. Then, control is obtained by remotely connecting to the unknown device, and cat / proc / os_info is input to obtain the operating system name and version information. The matches table is updated based on this information, and the device fingerprint characteristics in the fingerprint library are updated.

[0065] As a preferred implementation of this embodiment, when a new device joins the network, the network device fingerprint database is updated as follows:

[0066] Scan new devices to obtain IP addresses and MAC addresses and save them in the created list of devices to be scanned;

[0067] Compare the IP addresses and MAC addresses in the device list to be scanned with the original device list in the database to determine whether it is a new device. If the result is a known device, remove it from the device list to be scanned;

[0068] Perform a full scan of all new devices in the list of devices to be scanned, obtain the fingerprint characteristics of each new device, and then compare the fingerprint characteristics of each new device with the fingerprint characteristics in the network device fingerprint library. If a successful match is found, merge it into the known device type and add it to the device list of known devices;

[0069] A fuzzy match is initiated for a new device that has not been successfully matched. The fuzzy match is to compare the user terminal name, operating system characteristics, and open port characteristics of the new device and generate a corresponding fingerprint characteristic. A fingerprint name is then customized for the new device and added to the network device fingerprint library together with the corresponding fingerprint characteristic, IP address, and MAC address to generate a new device type. The device name is updated into the device list of known devices, and the update of the network device fingerprint library is completed.

[0070] In this embodiment, the actual operation of the new device is as follows:

[0071] In the designated network segment, perform nmap-sP 192.168.18.0 / 24 fast scan network device, online host IP address and MAC and enter the scanning list, the specific implementation code is as follows:

[0072]

[0073] Determine whether the new network device is a known device, if it is a known device, directly mark the device model, if it is an unknown device, start fuzzy matching nmap-O--osscan-guess, custom named aarch64-unknown-linux-gnu-001, the specific implementation code is as follows:

[0074]

[0075]

[0076] Finally, a new device is defined a fingerprint name, together with the corresponding fingerprint characteristics, IP address and MAC address are added to the network device fingerprint library, a new device type is generated, and the device name is updated to the device list of known devices, the specific implementation code is as follows:

[0077]

[0078]

[0079] Embodiment two:

[0080] A dynamic updating network device fingerprint storage system, comprising:

[0081] Device address acquisition module: implement traffic monitoring at the mirror port of the local area network core switching device, obtain the IP address and MAC address of all devices in the local area network and create a corresponding device list;

[0082] Fingerprint feature acquisition module: start full scan on all devices in the device list to obtain the fingerprint features of each device;

[0083] Fingerprint feature analysis module: according to the fingerprint features of each device, merge the same type of devices in the network device fingerprint library, and distinguish the known devices and unknown devices according to the existing network device fingerprint library;

[0084] The network device fingerprint library updating module: connecting unknown devices through remote connection according to the IP address and MAC address of the devices, obtaining the operating system information of the unknown devices and updating the fingerprint features of the corresponding unknown devices in the network device fingerprint library, merging the same type of devices in the network device fingerprint library, and completing the network device fingerprint library updating.

[0085] As a preferred embodiment of the present embodiment, the specific steps of creating the network device fingerprint library and storing the IP address, MAC address and fingerprint features of all devices in the network device fingerprint library are as follows:

[0086] The fingerprint features of each device are converted into readable data exchange files through scanning and parsing software at the network connection end of each device, and a feature matching table is obtained, wherein the feature matching table contains operating system name and version information; then the fingerprint features of each device, the readable data exchange files corresponding to the fingerprint features, the IP address and the MAC address are stored in the network device fingerprint library.

[0087] As a preferred embodiment of the present embodiment, the specific operation steps of merging the same type of devices in the network device fingerprint library according to the fingerprint features of each device, and distinguishing known devices and unknown devices according to the existing network device fingerprint are as follows:

[0088] According to the operating system name and version information of each device as the classification standard, the same type of devices are merged, and then the device fingerprints corresponding to the merged various types of devices are compared with the existing network device fingerprint to confirm the device model; according to the matching result, all devices are classified, the known devices are marked with the device model, and the devices that cannot be matched are marked as unknown devices.

[0089] As a preferred embodiment of the present embodiment, it further includes the updating steps of the network device fingerprint library when a new device is connected to the network:

[0090] Scanning the new device to obtain the IP address and MAC address and storing them in the created to-be-scanned device list;

[0091] Comparing the to-be-scanned device list with the IP address and MAC address in the original device list in the database to determine whether it is a new device, and removing the known devices from the to-be-scanned device list according to the determination result;

[0092] Performing full scanning on the new devices in the to-be-scanned device list to obtain the fingerprint features of each new device, and then comparing the fingerprint features of each new device with the fingerprint features in the network device fingerprint library; merging the matched devices into the known device type and adding them to the device list of the known devices;

[0093] If the matching is unsuccessful, the new device initiates a fuzzy matching, which is a comparison of the user name, operating system features and open port features of the new device, and generates corresponding fingerprint features; then a fingerprint name is defined for the new device, and the corresponding fingerprint features, IP address and MAC address are added to the network device fingerprint library to generate a new device type, and the device name is updated into the device list of known devices, and the network device fingerprint library is updated.

[0094] Embodiment three:

[0095] The electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the method for creating a dynamically updated network device fingerprint library according to any one of the embodiments of the application when executing the program.

[0096] Embodiment four:

[0097] A computer readable storage medium, which stores a computer program executable by a processor to implement the method for creating a dynamically updated network device fingerprint library according to any one of the embodiments of the application.

[0098] The above description is only an embodiment of the application, and does not limit the patent scope of the application, and any equivalent structure or equivalent process transformation, or direct or indirect application in other related technical fields, is also included in the patent protection scope of the application.

Claims

1. A method for creating a dynamically updated network device fingerprint database, characterized in that: The specific steps are: Implement traffic monitoring at the mirror port of the LAN core switching device to obtain the IP addresses and MAC addresses of all devices in the LAN and create a corresponding device list; Initiate a full scan of all devices in the device list to obtain fingerprint features of each device; Create a network device fingerprint database and store the IP addresses, MAC addresses and fingerprint features of all devices in the network device fingerprint database; Merging devices of the same type in the network device fingerprint library according to the fingerprint characteristics of each device, and distinguishing known devices from unknown devices according to the existing network device fingerprint library; Acquire control rights by remotely connecting to an unknown device based on the device's IP address and MAC address, and further obtain operating system information of the unknown device. At the same time, update the fingerprint features of the corresponding unknown device in the network device fingerprint library, merge similar devices in the network device fingerprint library, and complete the network device fingerprint library update; When a new device joins the network, the network device fingerprint database is updated as follows: Scan new devices to obtain IP addresses and MAC addresses and save them in the created list of devices to be scanned; Compare the IP addresses and MAC addresses in the device list to be scanned with the original device list in the database to determine whether it is a new device. If the result is a known device, remove it from the device list to be scanned; Perform a full scan of all new devices in the list of devices to be scanned, obtain the fingerprint characteristics of each new device, and then compare the fingerprint characteristics of each new device with the fingerprint characteristics in the network device fingerprint library. If a successful match is found, merge it into the known device type and add it to the device list of known devices; A fuzzy match is initiated for new devices that have not been successfully matched. The fuzzy match is performed by comparing the user terminal name, operating system characteristics, and open port characteristics of the new device to generate a corresponding fingerprint characteristic. A fingerprint name is then customized for the new device and added to the network device fingerprint library along with the corresponding fingerprint characteristic, IP address, and MAC address to generate a new device type. The device name is then updated to the device list of known devices, and the network device fingerprint library is updated. After multiple scans, it is confirmed that all unknown devices in the device list are updated to known devices, and the network device fingerprint library is created.

2. The method for creating a dynamically updated network device fingerprint database according to claim 1, characterized in that: The specific steps of creating a network device fingerprint library and storing the IP addresses, MAC addresses, and fingerprint features of all devices in the network device fingerprint library are as follows: At the network connection end of each device, the fingerprint features of each device are converted into a readable data exchange file through scanning and parsing software, and a feature matching table is obtained, wherein the feature matching table contains the operating system name and version information; then the fingerprint features of each device, the readable data exchange file corresponding to the fingerprint features, the IP address and the MAC address are stored in the network device fingerprint library.

3. The method for creating a dynamically updated network device fingerprint database according to claim 2, characterized in that: The specific operation steps of merging the same type of devices in the network device fingerprint library according to the fingerprint characteristics of each device and distinguishing known devices from unknown devices according to the existing network device fingerprint library are as follows: Based on the operating system name and version information of each device as the classification standard, devices of the same type are merged, and then the device fingerprints corresponding to the merged various types of devices are compared with the existing network device fingerprint library to confirm the device model. All devices are classified according to the matching results. Known devices are marked with the device model, and devices that cannot be matched are marked as unknown devices.

4. A dynamically updated network device fingerprint storage system, characterized in that: include: Device address acquisition module: implements traffic monitoring at the mirror port of the LAN core switching device, obtains the IP addresses and MAC addresses of all devices in the LAN and creates a corresponding device list; Fingerprint feature acquisition module: initiates a full scan of all devices in the device list to obtain the fingerprint features of each device; creates a network device fingerprint library and stores the IP addresses, MAC addresses and fingerprint features of all devices in the network device fingerprint library; Fingerprint feature analysis module: merges devices of the same type in the network device fingerprint library according to the fingerprint features of each device, and distinguishes known devices from unknown devices based on the existing network device fingerprint library; Network device fingerprint library update module: obtains control rights by remotely connecting to unknown devices based on the device's IP address and MAC address, and further obtains the operating system information of the unknown device. At the same time, it updates the fingerprint features of the corresponding unknown device in the network device fingerprint library, merges similar devices in the network device fingerprint library, and completes the network device fingerprint library update; When a new device joins the network, the network device fingerprint database is updated as follows: Scan new devices to obtain IP addresses and MAC addresses and save them in the created list of devices to be scanned; Compare the IP addresses and MAC addresses in the device list to be scanned with the original device list in the database to determine whether it is a new device. If the result is a known device, remove it from the device list to be scanned; Perform a full scan of all new devices in the list of devices to be scanned, obtain the fingerprint characteristics of each new device, and then compare the fingerprint characteristics of each new device with the fingerprint characteristics in the network device fingerprint library. If a successful match is found, merge it into the known device type and add it to the device list of known devices; A fuzzy match is initiated for new devices that have not been successfully matched. The fuzzy match is performed by comparing the user terminal name, operating system characteristics, and open port characteristics of the new device to generate a corresponding fingerprint characteristic. A fingerprint name is then customized for the new device and added to the network device fingerprint library along with the corresponding fingerprint characteristic, IP address, and MAC address to generate a new device type. The device name is then updated to the device list of known devices, and the network device fingerprint library is updated. After multiple scans, it is confirmed that all unknown devices in the device list are updated to known devices, and the network device fingerprint library is created.

5. A dynamically updated network device fingerprint storage system according to claim 4, characterized in that: The specific steps of creating a network device fingerprint library and storing the IP addresses, MAC addresses, and fingerprint features of all devices in the network device fingerprint library are as follows: At the network connection end of each device, the fingerprint features of each device are converted into a readable data exchange file through scanning and parsing software, and a feature matching table is obtained, wherein the feature matching table contains the operating system name and version information; then the fingerprint features of each device, the readable data exchange file corresponding to the fingerprint features, the IP address and the MAC address are stored in the network device fingerprint library.

6. A dynamically updated network device fingerprint storage system according to claim 4, characterized in that: The specific operation steps of merging the same type of devices in the network device fingerprint library according to the fingerprint characteristics of each device and distinguishing known devices from unknown devices according to the existing network device fingerprint library are as follows: Based on the operating system name and version information of each device as the classification standard, devices of the same type are merged, and then the device fingerprints corresponding to the merged various types of devices are compared with the existing network device fingerprint library to confirm the device model. All devices are classified according to the matching results. Known devices are marked with the device model, and devices that cannot be matched are marked as unknown devices.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for creating a dynamically updated network device fingerprint database according to any one of claims 1 to 3 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for creating a dynamically updated network device fingerprint database according to any one of claims 1 to 3 is implemented.

Images