A network traffic aggregation statistics-based asset fingerprint extraction method and system

Abstract

The application provides a network traffic aggregation statistics-based asset fingerprint extraction method and system. The method comprises: obtaining a first asset fingerprint feature set of a target network asset device by passive detection, the set comprising uplink and downlink traffic of each network protocol of the target network asset device within a predetermined time period; obtaining a second asset fingerprint feature set of the target network asset device by active detection, the set comprising each inherent attribute feature of the target network asset device; performing weighted calculation on each fingerprint feature of the two asset fingerprint feature sets based on a predetermined weight algorithm; and constructing an asset fingerprint of the target network asset device according to the two asset fingerprint feature sets obtained by the weighted calculation. The system comprises various functional modules corresponding to the above steps. According to the application, the problem that the network asset fingerprint constructed by the existing network asset fingerprint extraction method cannot comprehensively reflect the characteristic attributes of the network asset is solved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of information system security management, and more particularly relates to a network traffic aggregation statistical asset fingerprint extraction method and system. BACKGROUND

[0002] In recent years, network asset fingerprint extraction technology has been increasingly applied in the Internet of Things and network security industries. The network asset fingerprint obtained based on network asset fingerprint extraction technology is the "identity card" of the network asset and is also the basis for information system security management. By identifying the network asset fingerprint, affected information systems can be quickly matched in the event of a 0day outbreak, and assets that are illegally opened can be found, thereby facilitating security operation management and ensuring the stable implementation of security systems.

[0003] Existing network asset fingerprint extraction methods mainly use active detection methods, i.e., various high-speed network scanning technologies such as host alive detection, port scanning, and service identification, to actively send constructed probe packets to target network assets and extract target features from the relevant information of the returned response packets to construct network asset fingerprints. The extracted target features mainly include the physical address, port, operating system type, and service type of the network asset. However, although the above network asset fingerprint extraction method can construct network asset fingerprints in certain information dimensions, the constructed network asset fingerprints are not comprehensive enough to fully reflect the characteristic attributes of network assets. SUMMARY

[0004] The present application aims to solve the problem that the network asset fingerprints constructed by existing network asset fingerprint extraction methods cannot fully reflect the characteristic attributes of network assets.

[0005] To achieve the above-mentioned purpose, the present application provides a network traffic aggregation statistical asset fingerprint extraction method and system.

[0006] According to a first aspect of the present application, a network traffic aggregation statistical asset fingerprint extraction method is provided, which comprises the following steps:

[0007] A first asset fingerprint feature set of a target network asset device is obtained by using passive detection, and the first asset fingerprint feature set includes the uplink and downlink traffic of each network protocol of the target network asset device within a predetermined time period, and the network protocols include general network protocols and proprietary network protocols;

[0008] A second asset fingerprint feature set of the target network asset device is obtained by using active detection, and the second asset fingerprint feature set includes each inherent attribute feature of the target network asset device.

[0009] weighting each asset fingerprint feature in the first asset fingerprint feature set and each asset fingerprint feature in the second asset fingerprint feature set based on a predetermined weight algorithm to obtain a weight sum of the first asset fingerprint feature set and a weight sum of the second asset fingerprint feature set;

[0010] constructing the asset fingerprint of the target network asset device according to the first asset fingerprint feature set and the second asset fingerprint feature set after weighting calculation.

[0011] Optionally, the general network protocol includes HTTP protocol and MDNS protocol.

[0012] Optionally, if the target network asset device is a network camera, the specific network protocol includes RTSP protocol and RTP protocol.

[0013] Optionally, if the target network asset device is a computer, the specific network protocol includes TELNET protocol, FTP_CONTROL protocol and SMBV1 protocol.

[0014] Optionally, the inherent attribute feature includes an operating system fingerprint, an operating system type and an asset type of the target network asset device.

[0015] Optionally, the weighting calculation of each asset fingerprint feature in the first asset fingerprint feature set based on a predetermined weight algorithm includes:

[0016] obtaining an uplink traffic weight sum and a downlink traffic weight sum of each network protocol respectively;

[0017] summing all the obtained uplink traffic weight sum and downlink traffic weight sum to obtain the weight sum of the first asset fingerprint feature set.

[0018] Optionally, the method for obtaining the uplink traffic weight sum of the target network protocol includes:

[0019] obtaining a proportion of the uplink traffic of the target network protocol in the uplink and downlink traffic of all network protocols;

[0020] multiplying the proportion by the predetermined weight of the first asset fingerprint feature set to obtain the uplink traffic weight sum of the target network protocol.

[0021] Optionally, the method for obtaining the uplink traffic weight sum of the target network protocol includes:

[0022] obtaining a proportion of the uplink traffic of the target network protocol in the uplink and downlink traffic of all network protocols;

[0023] The product of the proportion, the predetermined weight of the first asset fingerprint feature set, and the ranking weight of the uplink traffic of the target network protocol is taken as an uplink traffic weight score of the target network protocol.

[0024] The ranking weight of the uplink traffic of the target network protocol is determined based on the ranking of the uplink traffic of the target network protocol in the uplink traffic and the downlink traffic of each target network protocol and a predetermined mapping relationship between traffic ranking and ranking weight.

[0025] According to a second aspect of the present application, there is provided an asset fingerprint extraction system based on network traffic aggregation statistics, comprising the following functional modules:

[0026] A first asset fingerprint feature set acquisition module is configured to acquire a first asset fingerprint feature set of a target network asset device by passive detection, wherein the first asset fingerprint feature set comprises uplink traffic and downlink traffic of each network protocol of the target network asset device within a predetermined time period, and the network protocols include general network protocols and special network protocols.

[0027] A second asset fingerprint feature set acquisition module is configured to acquire a second asset fingerprint feature set of the target network asset device by active detection, wherein the second asset fingerprint feature set comprises each inherent attribute feature of the target network asset device.

[0028] A weighting calculation module is configured to perform weighting calculation on each asset fingerprint feature in the first asset fingerprint feature set and each asset fingerprint feature in the second asset fingerprint feature set based on a predetermined weighting algorithm, so as to acquire a weight score of the first asset fingerprint feature set and a weight score of the second asset fingerprint feature set.

[0029] An asset fingerprint construction module is configured to construct an asset fingerprint of the target network asset device according to the first asset fingerprint feature set and the second asset fingerprint feature set obtained by weighting calculation.

[0030] Optionally, the general network protocols include HTTP protocol and MDNS protocol.

[0031] And / or,

[0032] If the target network asset device is a network camera, the special network protocols include RTSP protocol and RTP protocol.

[0033] And / or,

[0034] If the target network asset device is a computer, the special network protocols include TELNET protocol, FTP_CONTROL protocol, and SMBV1 protocol.

[0035] and / or,

[0036] The inherent attribute features include an operating system fingerprint, an operating system type and an asset type of the target network asset device.

[0037] The present application has the beneficial effects that:

[0038] The asset fingerprint extraction method based on network traffic aggregation statistics of the present application firstly acquires the uplink and downlink traffic features of each network protocol of the target network asset device within a predetermined time period in a passive detection manner; simultaneously acquires the inherent attribute features of the target network asset device in an active detection manner; secondly weights each asset fingerprint feature acquired; and finally constructs the asset fingerprint of the target network asset device based on the weighted asset fingerprint features.

[0039] The asset fingerprint extraction method based on network traffic aggregation statistics of the present application simultaneously acquires the fingerprint features of the target network asset device in multiple information dimensions in a passive detection manner and an active detection manner, and constructs the asset fingerprint of the target network asset device by comprehensively considering the time dimension and the weight dimension. It can be known that, compared with the existing network asset fingerprint extraction method based on only the active detection manner, the asset fingerprint constructed by the asset fingerprint extraction method based on network traffic aggregation statistics of the present application can more comprehensively and pertinently reflect the characteristic attributes of the target network asset device.

[0040] The asset fingerprint extraction system based on network traffic aggregation statistics of the present application and the above-mentioned asset fingerprint extraction method based on network traffic aggregation statistics belong to one general inventive concept, and at least have the same beneficial effects as the above-mentioned asset fingerprint extraction method based on network traffic aggregation statistics. The beneficial effects will not be repeated here.

[0041] Other features and advantages of the present application will be described in detail in the following specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0042] The present application can be better understood by reference to the following description taken in conjunction with the accompanying drawings, in which like reference numerals are used to indicate identical or similar components throughout the various figures.

[0043] Figure 1 An implementation flowchart of the asset fingerprint extraction method based on network traffic aggregation statistics according to an embodiment of the present application is shown;

[0044] Figure 2 A structural block diagram of the asset fingerprint extraction system based on network traffic aggregation statistics according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0045] In order to enable a person skilled in the art to more fully understand the technical solutions of the present application, in the following, exemplary embodiments of the present application will be described more fully and in detail with reference to the accompanying drawings. Obviously, the following described one or more embodiments of the present application are only one or more of the specific manners in which the technical solutions of the present application can be implemented, and are not exhaustive. It should be understood that the technical solutions of the present application can be implemented in other manners belonging to the same general inventive concept without being limited by the exemplary described embodiments. Based on one or more embodiments of the present application, all other embodiments obtained by a person skilled in the art without creative labor should belong to the scope of protection of the present application.

[0046] Embodiments: Figure 1 An implementation flowchart of the asset fingerprint extraction method based on network traffic aggregation statistics of an embodiment of the present application is shown. Referring to Figure 1 , the asset fingerprint extraction method based on network traffic aggregation statistics of an embodiment of the present application includes the following steps:

[0047] Step S100, a first asset fingerprint feature set of a target network asset device is obtained in a passive detection manner, the first asset fingerprint feature set including uplink traffic and downlink traffic of each network protocol of the target network asset device within a predetermined time period, the each network protocol including a general network protocol and a proprietary network protocol;

[0048] Step S200, a second asset fingerprint feature set of the target network asset device is obtained in an active detection manner, the second asset fingerprint feature set including each inherent attribute feature of the target network asset device;

[0049] Step S300, each asset fingerprint feature in the first asset fingerprint feature set and each asset fingerprint feature in the second asset fingerprint feature set are calculated by weighting based on a predetermined weight algorithm, to obtain a weight sum of the first asset fingerprint feature set and a weight sum of the second asset fingerprint feature set;

[0050] Step S400, an asset fingerprint of the target network asset device is constructed according to the first asset fingerprint feature set and the second asset fingerprint feature set calculated by weighting.

[0051] Specifically, in the embodiment of the present application, the uplink traffic of the target network asset device refers to the traffic sent by the target network asset device, and the downlink traffic of the target network asset device refers to the traffic received by the target network asset device. For example, device A sends a network request to device B, and then device B returns response information to device A, wherein the network request sent by device A is the uplink traffic of device A, and the response information returned by device B is the downlink traffic of device A (because it is also a session initiated by device A, only that device B responds).

[0052] Specifically, in the embodiment of the present application, when the asset fingerprint extraction method acquires the uplink traffic and the downlink traffic of each network protocol of the target network asset device in a passive detection manner, a suitable time dimension is set according to the actual situation, so that a large enough amount of data can be acquired to reflect the traffic characteristics of the target network asset device. In the embodiment of the present application, the time dimension is 30 minutes, that is, the uplink traffic and the downlink traffic of each network protocol of the target network asset device within 30 minutes are acquired, and then the uplink traffic and the downlink traffic of each network protocol are aggregated and counted to obtain a first asset fingerprint feature set. An exemplary aggregation and counting result of network protocol traffic is as follows:

[0053] {

[0054] "DOWN_HTTP": 1000,

[0055] "DOWN_MDNS": 800,

[0056] "UP_HTTP": 400,

[0057] "UP_MDNS": 200,

[0058] }

[0059] According to the aggregation and counting result, the downlink HTTP traffic of the target network asset device is 1000 bytes, the downlink MDNS traffic is 800 bytes, the uplink HTTP traffic is 400 bytes, and the uplink MDNS traffic is 200 bytes.

[0060] Further, in step S100 of the embodiment of the present application, the general network protocol of the target network asset device includes the HTTP protocol and the MDNS protocol; the proprietary network protocol of the target network asset device is related to the type of the target network asset device, if the target network asset device is a network camera, the proprietary network protocol includes the RTSP protocol and the RTP protocol; if the target network asset device is a computer, the proprietary network protocol includes the TELNET protocol, the FTP_CONTROL protocol and the SMBV1 protocol.

[0061] Further, in step S200 of the embodiment of the present application, the inherent attribute features include the operating system fingerprint, the operating system type and the asset type of the target network asset device.

[0062] In the embodiment of the present application, the active detection mode is realized by means of the Nmap scanning tool. Specifically, after the related parameters of the Nmap scanning tool are configured, the Nmap scanning tool sends a scanning detection packet to the target network asset device, and acquires the operating system fingerprint, the operating system type and the asset type of the target network asset device from the returned response packet, which are important components of the asset fingerprint information statistics.

[0063] Further, in step S300 of the embodiment of the present application, the weighting calculation of each asset fingerprint feature in the first asset fingerprint feature set based on the predetermined weighting algorithm includes:

[0064] The uplink traffic weight fraction and the downlink traffic weight fraction of each network protocol are acquired respectively;

[0065] The acquired uplink traffic weight fraction and downlink traffic weight fraction are summed to obtain the weight fraction of the first asset fingerprint feature set.

[0066] Further, in the embodiment of the present application, the method for acquiring the uplink traffic weight fraction of the target network protocol includes:

[0067] The proportion of the uplink traffic of the target network protocol in the uplink and downlink traffic of all network protocols is acquired;

[0068] The product of the proportion and the predetermined weight of the first asset fingerprint feature set is taken as the uplink traffic weight fraction of the target network protocol.

[0069] Specifically, the weighting calculation is explained in more detail based on the above exemplary aggregation statistical result of the network protocol traffic:

[0070] If the proportion of the network protocol traffic of the target network asset device in the fingerprint feature identification is 30%, i.e., the weight of the first asset fingerprint feature set is 30%, then the uplink and downlink traffic weight fractions of each network protocol are:

[0071] DOWN_HTTP=1000 / 2400*30 / 100=0.125

[0072] DOWN_MDNS=800 / 2400*30 / 100=0.1

[0073] UP_HTTP=400 / 2400*30 / 100=0.05

[0074] UP_MDNS = 200 / 2400 * 30 / 100 = 0.025

[0075] After the asset fingerprint is constructed, when the uplink and downlink traffic of the target network asset device is judged for compliance, the weight calculation method can be used. For example, the network protocol traffic reported by the target network asset device is as follows:

[0076] {

[0077] DOWN_HTTP: 1000, DOWN_MDNS: 800, UP_HTTP: 400, UP_NETBIOS: 200

[0078] }

[0079] According to the network protocol traffic reported by the target network asset device, the downlink HTTP traffic, the downlink MDNS traffic, the uplink HTTP traffic and the uplink NETBIOS traffic are involved, and the network protocol traffic involved in the constructed asset fingerprint includes the downlink HTTP traffic, the downlink MDNS traffic, the uplink HTTP traffic and the uplink MDNS traffic. The common network protocol traffic of the two is the downlink HTTP traffic, the downlink MDNS traffic and the uplink HTTP traffic. The weight score calculation of the network protocol traffic reported by the target network asset device is as follows:

[0080] DOWN_HTTP = 1000 / 2400 * 30 / 100 = 0.125

[0081] DOWN_MDNS = 800 / 2400 * 30 / 100 = 0.1

[0082] UP_HTTP = 400 / 2400 * 30 / 100 = 0.05

[0083] 0.125 + 0.1 + 0.05 = 0.275

[0084] According to the calculation result, the weight total score of the network protocol traffic reported by the target network asset device is 0.275, which is 0.025 less than the uplink and downlink traffic proportion (0.3) in the asset fingerprint. This is because the uplink MDNS traffic is missing.

[0085] As an optional implementation, in the embodiment of the application, the method for obtaining the weight score of the uplink traffic of the target network protocol includes:

[0086] obtaining the proportion of the uplink traffic of the target network protocol in the uplink and downlink traffic of all network protocols;

[0087] The product of the proportion, the predetermined weight of the first asset fingerprint feature set, and the ranking weight of the uplink traffic of the target network protocol is taken as the uplink traffic weight score of the target network protocol.

[0088] The ranking weight of the uplink traffic of the target network protocol is determined based on the ranking of the uplink traffic of the target network protocol in the uplink traffic and the downlink traffic of each target network protocol and a predetermined mapping relationship between traffic ranking and ranking weight.

[0089] Specifically, in the embodiment of the present application, the ranking of the network protocol traffic in the asset fingerprint in the above-mentioned exemplary aggregation statistical result of network protocol traffic is in turn downlink HTTP traffic, downlink MDNS traffic, uplink HTTP traffic, and uplink MDNS traffic. In the network protocol traffic reported by the target network asset device in the identification process, the ranking of the downlink HTTP traffic, the downlink MDNS traffic, and the uplink HTTP traffic does not change, and only the uplink MDNS traffic becomes uplink NETBIOS traffic. In this case, it is not necessary to add a ranking weight to each network protocol traffic in the process of constructing the asset fingerprint. If the ranking of the downlink HTTP traffic, the downlink MDNS traffic, and the uplink HTTP traffic in the network protocol traffic reported by the target network asset device in the identification process changes, a ranking weight can be added to each network protocol traffic, such as the product of the proportion, the predetermined weight of the first asset fingerprint feature set, and the ranking weight of the uplink traffic of the target network protocol.

[0090] The asset fingerprint extraction method based on network traffic aggregation statistics in the embodiment of the present application aggregates and statistically analyzes the uplink traffic and the downlink traffic of each network protocol of the network asset device in a predetermined time period, which records the historical access record of the network asset device to a certain extent.

[0091] The asset fingerprint extraction method based on network traffic aggregation statistics in the embodiment of the present application identifies asset traffic in a passive detection and active detection manner, and then combines the time dimension, the uplink traffic dimension, the asset type dimension, the asset operating system dimension, the fingerprint information of the operating system of the FingerPrint host, the dimension of the special network protocol of the asset, and the weighting algorithm to comprehensively construct the asset fingerprint.

[0092] The asset fingerprint extraction method based on network flow aggregation statistics provided in the embodiment of the present application takes network session messages of network asset devices as data sources, collects source IP, source port number, target IP, target port number, network protocol, user agent, JA3C fingerprint, system category and Type asset type and the like, takes interval time period as a benchmark, cooperates with a weight algorithm, aggregates and counts network sessions, and thus extracts fingerprint features of network asset devices.

[0093] The asset fingerprint extraction method based on network flow aggregation statistics provided in the embodiment of the present application has low performance consumption and small bandwidth load, adopts network bypass detection, and does not affect normal working environment of a backbone network.

[0094] Correspondingly, based on the asset fingerprint extraction method based on network flow aggregation statistics provided in the embodiment of the present application, the embodiment of the present application further provides an asset fingerprint extraction system based on network flow aggregation statistics.

[0095] Figure 2 The structure block diagram of the asset fingerprint extraction system based on network flow aggregation statistics provided in the embodiment of the present application is shown. Figure 2 The asset fingerprint extraction system based on network flow aggregation statistics provided in the embodiment of the present application comprises the following functional modules:

[0096] The first asset fingerprint feature set acquisition module is configured to acquire a first asset fingerprint feature set of a target network asset device by using a passive detection manner, wherein the first asset fingerprint feature set comprises uplink flow and downlink flow of each network protocol of the target network asset device within a predetermined time period, and the each network protocol comprises a general network protocol and a special network protocol;

[0097] The second asset fingerprint feature set acquisition module is configured to acquire a second asset fingerprint feature set of the target network asset device by using an active detection manner, wherein the second asset fingerprint feature set comprises each inherent attribute feature of the target network asset device;

[0098] The weight calculation module is configured to perform weight calculation on each asset fingerprint feature in the first asset fingerprint feature set and each asset fingerprint feature in the second asset fingerprint feature set based on a predetermined weight algorithm, so as to acquire a weight sum of the first asset fingerprint feature set and a weight sum of the second asset fingerprint feature set;

[0099] The asset fingerprint construction module is configured to construct an asset fingerprint of the target network asset device according to the first asset fingerprint feature set and the second asset fingerprint feature set subjected to the weight calculation.

[0100] While one or more embodiments of the application have been described above, it should be recognized that the application might be practiced without departing from the spirit and scope of the application. Accordingly, the above description is intended for illustrative and not restrictive purposes. Numerous modifications and variations are possible in light of the above teachings.

Claims

1. A method for asset fingerprint extraction based on network traffic aggregation statistics, characterized in that, The method comprises the following steps: obtaining a first asset fingerprint feature set of a target network asset device by passive detection, wherein the first asset fingerprint feature set comprises uplink traffic and downlink traffic of each network protocol of the target network asset device within a predetermined time period, and the each network protocol comprises a general network protocol and a specific network protocol; obtaining a second asset fingerprint feature set of the target network asset device by active detection, wherein the second asset fingerprint feature set comprises each inherent attribute feature of the target network asset device; performing weighted calculation on each asset fingerprint feature in the first asset fingerprint feature set and each asset fingerprint feature in the second asset fingerprint feature set based on a predetermined weight algorithm to obtain a weight sum of the first asset fingerprint feature set and a weight sum of the second asset fingerprint feature set; constructing an asset fingerprint of the target network asset device according to the first asset fingerprint feature set and the second asset fingerprint feature set obtained by the weighted calculation; the weighted calculation on each asset fingerprint feature in the first asset fingerprint feature set based on the predetermined weight algorithm comprises: obtaining an uplink traffic weight sum and a downlink traffic weight sum of each network protocol respectively; summing all the obtained uplink traffic weight sums and downlink traffic weight sums to obtain the weight sum of the first asset fingerprint feature set; the method for obtaining the uplink traffic weight sum of the target network protocol comprises: obtaining a proportion of the uplink traffic of the target network protocol in the uplink traffic and the downlink traffic of all the network protocols; multiplying the proportion, the predetermined weight of the first asset fingerprint feature set and the ranking weight of the uplink traffic of the target network protocol to obtain the uplink traffic weight sum of the target network protocol; the ranking weight of the uplink traffic of the target network protocol is determined based on the ranking of the uplink traffic of the target network protocol in the uplink traffic and the downlink traffic of each target network protocol and a predetermined mapping relationship between the traffic ranking and the ranking weight.

2. The method for extracting asset fingerprint based on network traffic aggregation statistics according to claim 1, characterized in that, The general network protocol comprises an HTTP protocol and an MDNS protocol.

3. The method for extracting asset fingerprint based on network traffic aggregation statistics according to claim 1, characterized in that, If the target network asset device is a network camera, the specific network protocol comprises an RTSP protocol and an RTP protocol.

4. The method for extracting asset fingerprint based on network traffic aggregation statistics according to claim 1, characterized in that, If the target network asset device is a computer, the specific network protocol comprises a TELNET protocol, an FTP_CONTROL protocol and an SMBV1 protocol.

5. The method for extracting asset fingerprint based on network traffic aggregation statistics according to claim 1, characterized in that, The inherent attribute feature comprises an operating system fingerprint, an operating system type and an asset type of the target network asset device.

6. A system for asset fingerprint extraction based on network traffic aggregation statistics, characterized in that, The method comprises the following steps: a first asset fingerprint feature set obtaining module is configured to obtain a first asset fingerprint feature set of a target network asset device by passive detection, wherein the first asset fingerprint feature set comprises uplink traffic and downlink traffic of each network protocol of the target network asset device within a predetermined time period, and the each network protocol comprises a general network protocol and a specific network protocol; a second asset fingerprint feature set obtaining module is configured to obtain a second asset fingerprint feature set of the target network asset device by active detection, wherein the second asset fingerprint feature set comprises each inherent attribute feature of the target network asset device; a weighting calculation module, configured to perform a weighting calculation on each asset fingerprint feature in the first asset fingerprint feature set and each asset fingerprint feature in the second asset fingerprint feature set based on a predetermined weight algorithm, to obtain a weight sum of the first asset fingerprint feature set and a weight sum of the second asset fingerprint feature set; an asset fingerprint construction module, configured to construct an asset fingerprint of the target network asset device according to the first asset fingerprint feature set and the second asset fingerprint feature set obtained through the weighting calculation; the weighting calculation on each asset fingerprint feature in the first asset fingerprint feature set based on the predetermined weight algorithm comprises: obtaining an uplink traffic weight sum and a downlink traffic weight sum of each network protocol respectively; summing all the obtained uplink traffic weight sums and downlink traffic weight sums to obtain the weight sum of the first asset fingerprint feature set; the method for obtaining the uplink traffic weight sum of the target network protocol comprises: obtaining a proportion of the uplink traffic of the target network protocol in the uplink and downlink traffic of all network protocols; multiplying the proportion, the predetermined weight of the first asset fingerprint feature set and the ranking weight of the uplink traffic of the target network protocol to obtain the uplink traffic weight sum of the target network protocol; the ranking weight of the uplink traffic of the target network protocol is determined based on a ranking of the uplink traffic of the target network protocol in the uplink and downlink traffic of each target network protocol and a predetermined mapping relationship between traffic ranking and ranking weight.

7. The network traffic aggregation statistics based asset fingerprint extraction system of claim 6, wherein, the general network protocol comprises an HTTP protocol and an MDNS protocol; and / or, if the target network asset device is a network camera, the specific network protocol comprises an RTSP protocol and an RTP protocol; and / or, if the target network asset device is a computer, the specific network protocol comprises a TELNET protocol, an FTP_CONTROL protocol and an SMBV1 protocol; and / or, the inherent attribute feature comprises an operating system fingerprint, an operating system type and an asset type of the target network asset device.

Images