Network data fusion-based network electricity feature acquisition method and device, and electronic equipment

Abstract

The application discloses a network data fusion-based network electricity feature acquisition method and device and electronic equipment. The method comprises the following steps: intercepting multiple target signals from multiple frequency band signals; extracting network feature information of each target signal; acquiring a communication relationship of the target signals according to a pairing relationship of IP addresses or MAC addresses of the target signals; acquiring a correlation relationship of the target signals according to a coincidence relationship of the IP addresses or the MAC addresses of the target signals; attributing different signals to the same platform according to the correlation relationship, and acquiring platform attributes of each target signal according to a platform attribute of a known signal; acquiring a topology relationship between platforms to which the target signals belong according to the platform attributes of each target signal and the communication relationship; and inferring a possible communication relationship between different frequency band signals according to the topology relationship between the platforms to which the target signals belong. The application solves the problems of signal communication, platform correlation and communication inference of a communication system.

Description

Technical Field

[0001] This invention relates to the field of network electromagnetic (network electrical) data processing, and more specifically to a method, apparatus, and electronic device for obtaining network electrical features based on network data fusion. Background Technology

[0002] With the rapid development of wireless communication, electromagnetic and network technologies are highly interconnected and integrated. Uncovering hidden electromagnetic and network characteristics through electromagnetic spectrum monitoring is crucial for timely understanding and effective management of wireless communication networks. For example, identifying communication relationships can reveal important nodes in a wireless communication network, uncover network characteristics such as target attributes and behavioral relationships, and further infer the intrinsic relationships between communication targets, analyze platform attributes, and understand the electromagnetic network topology. However, current technologies have limited expertise in mining the hidden information in electromagnetic spectrum monitoring data, and there are no reported studies utilizing spectrum monitoring data to analyze signal communication and platform relationships. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to propose a method, device, and electronic device for obtaining network electrical features based on network data fusion.

[0004] According to a first aspect of the present invention, a method for obtaining network electrical features based on network data fusion is provided, comprising:

[0005] Multiple target signals were intercepted from multiple frequency band signals;

[0006] Extract the network feature information of each target signal, the network feature information including IP address and / or MAC address;

[0007] Based on the pairing relationship of the IP address or MAC address of the target signal, obtain the communication relationship of each target signal;

[0008] Based on the overlap of IP addresses or MAC addresses of the target signals, obtain the correlation relationship of each target signal;

[0009] Different interconnected signals are assigned to the same platform, and the platform attributes are inferred based on the platform attributes of one of the known signals to obtain the platform attributes of each target signal.

[0010] Based on the platform attributes and communication relationships of each target signal, obtain the topological relationships between the platforms to which the target signal belongs;

[0011] Based on the topological relationship between the platforms to which the target signal belongs, the possible communication relationships between signals of different frequency bands can be inferred.

[0012] According to a second aspect of the present invention, a network-electricity feature acquisition device based on network data fusion is provided, comprising:

[0013] The signal interception module is used to intercept multiple target signals from multiple frequency band signals.

[0014] The feature extraction module is used to extract network feature information for each target signal, including IP address and / or MAC address;

[0015] The communication relationship acquisition module is used to acquire the communication relationship of each target signal based on the pairing relationship of the target signal's IP address or MAC address;

[0016] The association relationship acquisition module is used to obtain the association relationship of each target signal based on the overlap of the IP address or MAC address of the target signal;

[0017] The platform association module is used to assign different related signals to the same platform;

[0018] The platform attribute acquisition module is used to infer the attributes of the platform based on the platform attributes of one of the known signals, and to acquire the platform attributes of each target signal.

[0019] The platform topology acquisition module is used to acquire the topological relationship between the platforms to which the target signal belongs, based on the platform attributes and communication relationships of each target signal;

[0020] The communication relationship inference module is used to infer the possible communication relationships between signals in different frequency bands based on the topological relationship between the platforms to which the target signal belongs.

[0021] According to a third aspect of the present invention, an electronic device is provided, including a memory and a processor.

[0022] The memory stores a computer program, which is loaded and executed by the processor to implement the aforementioned method for obtaining network electrical features based on network data fusion.

[0023] The technical solution of the present invention can achieve the following beneficial effects:

[0024] The present invention proposes a method, apparatus, and electronic setup for acquiring network electrical features based on network data fusion, which can be used to mine network electrical feature information such as target attributes and behavioral relationships in wireless communication networks. By analyzing signal connectivity and signal correlation, platform correlation is performed, and platform topology relationships are obtained, further inferring possible connectivity relationships between signals in multiple frequency bands. The present invention effectively solves the problems of signal connectivity, platform correlation, and connectivity inference in communication systems, and features flexible connectivity analysis methods, novel signal correlation methods, and intuitive platform topology analysis. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of this invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are merely some embodiments recorded in this invention, and those skilled in the art can obtain other drawings based on these drawings. In the drawings:

[0026] Figure 1 This is a flowchart illustrating a method for obtaining network characteristics based on network data fusion proposed in this invention.

[0027] Figure 2 This is a schematic diagram of the working scenario of the multi-platform network data fusion object of the present invention;

[0028] Figure 3 Based on the embodiments of the present invention Figure 2 A flowchart illustrating the method for obtaining network characteristics in the work scenario shown.

[0029] Figure 4 This is a schematic diagram of data transmission in a digital communication system according to an embodiment of the present invention;

[0030] Figure 5 This is a schematic diagram of the data parsing process according to an embodiment of the present invention;

[0031] Figure 6 This is a schematic diagram of the structure of a network electrical feature acquisition device based on network data fusion proposed in this invention;

[0032] Figure 7 This is a schematic diagram of the structure of an electronic device proposed in this invention. Detailed Implementation

[0033] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. These embodiments should be understood as illustrative only and not as limiting the scope of protection of the present invention. After reading the description of the present invention, those skilled in the art can make various alterations or modifications to the present invention. These equivalent changes and modifications also fall within the scope of protection claimed by the present invention.

[0034] In this invention, "platform" refers to the facility that actually carries the signal radiation source. Depending on the deployment method, common platform types include space-based, ground-based, sea-based, and air-based. Among them, space-based platforms include heterogeneous satellites with various orbits and functions, as well as spacecraft and deep-space platforms; air-based platforms include various near-space platforms, civil aviation, and various unmanned aerial vehicles; ground-based platforms cover various wired and wireless network facilities on the ground; and sea-based platforms include surface ships, marine environmental sensing, and marine data transmission platforms, etc.

[0035] Analyzing and obtaining signal connections and correlations from massive electromagnetic spectrum monitoring data is fundamental to uncovering behavioral relationships and hidden information within wireless communication networks. By identifying signal connections and correlations, the platforms of associated signals can be determined, and the communication network topology can be obtained. How to achieve network-electromagnetic feature acquisition based on network data fusion through technical means is the problem this invention aims to solve.

[0036] In the field of communications reconnaissance, technologies such as signal analysis, signal parsing, and information data acquisition are relatively mature and are supporting technologies of this invention. In the following specific embodiments of this invention, the communication parameters (modulation, coding, frame structure, etc.) of the intercepted signal can be processed using various known technologies, which will not be described in detail here.

[0037] Figure 1 This is a flowchart illustrating a method for obtaining network electrical features based on network data fusion proposed in this invention. Figure 1 As shown, the grid power feature acquisition method of the present invention includes the following steps:

[0038] S110 intercepts multiple target signals from multiple frequency band signals;

[0039] S120, extract the network feature information of each target signal, the network feature information including IP address and / or MAC address;

[0040] S130: Obtain the communication relationship of each target signal based on the pairing relationship of the IP address or MAC address of the target signal;

[0041] S140, based on the overlap of the IP address or MAC address of the target signal, obtain the association relationship of each target signal;

[0042] S150 assigns different interconnected signals to the same platform;

[0043] S160, infer the platform attributes based on the platform attributes of one of the known signals, and obtain the platform attributes of each target signal;

[0044] S170, based on the platform attributes and communication relationships of each target signal, obtain the topological relationships between the platforms to which the target signal belongs;

[0045] S180, based on the topological relationship between the platforms to which the target signal belongs, infer the possible communication relationships between multiple frequency band signals.

[0046] like Figure 1As shown, steps S130 and S140 are parallel and can be executed simultaneously to obtain the communication and association relationships of each target signal, respectively. Alternatively, they can be executed sequentially; for example, step S130 can be executed first to obtain the communication relationships of each target signal, followed by step S140 to obtain the association relationships, or vice versa. Steps S150 and S160 are executed sequentially after step S140, and step S170 is executed after steps S160 and S130 have been completed.

[0047] The invention will now be illustrated with a specific application scenario. Figure 1 The steps in the process will be explained further.

[0048] Figure 2 This is a schematic diagram illustrating the working scenario of the multi-platform network data fusion object of the present invention. Figure 3 Based on the embodiments of the present invention Figure 2 The diagram illustrates the process of obtaining network power characteristics in the illustrated work scenario. (Combined with...) Figure 2 and Figure 3 The network-electricity feature acquisition method based on network data fusion proposed in this invention includes the following steps:

[0049] S310, Target Signal Interception

[0050] exist Figure 2 In the multi-platform network data fusion scenario shown, multiple frequency bands of signals include shortwave, ultra-shortwave, and microwave. Microwave is primarily used in satellite communication; therefore, microwave can be considered a satellite signal. This step involves detecting and intercepting multiple frequency bands of signals, including shortwave, ultra-shortwave, and satellite signals, to capture the target signal.

[0051] Figure 4 This is a schematic diagram of data transmission in a digital communication system according to an embodiment of the present invention. Figure 4 The various communication protocols of the digital communication system shown, such as modulation, coding, frame structure, and protocols, are all the same as existing technologies. The intercepted target signal is demodulated and decoded to obtain the data to be analyzed (network data packets carrying the signal), which is transmitted via inter-process communication.

[0052] S320, Network Feature Extraction

[0053] This step S320 includes: extracting the source IP address, destination IP address, source MAC address, and destination MAC address of the target signal from the network data packets carried by the target signal; obtaining the IP connection of the target signal based on the source IP address minus the destination IP address; obtaining the MAC connection of the target signal based on the source MAC address minus the destination MAC address; and storing the frequency, source IP address, destination IP address, source MAC address, destination MAC address, and acquisition time of the target signal as an analysis object in the database.

[0054] In this embodiment, the modulation, encoding, frame structure, and protocol of the intercepted target signal are analyzed to obtain network data and understand the characteristic information such as IP address and MAC address contained in the target signal.

[0055] Figure 5 This is a schematic diagram illustrating the data parsing process according to an embodiment of the present invention. Figure 5 Taking the Ethernet frame structure and IPv4 and IPv6 datagram structures shown as examples, after demodulating and decoding multiple intercepted target signals, IP address and MAC address information are extracted from the network data packets carried by the signals based on the data packet format through secondary development of network protocol analysis tools (such as Tshark).

[0056] The source IP address and source MAC address are used as the IP address and MAC address of this signal platform. A set of source IP addresses and destination IP addresses is called an IP connection, and a set of source MAC addresses and destination MAC addresses is called a MAC connection. The signal frequency, IP connection, and MAC connection are stored in a MongoDB database as a single analysis object. Its storage structure is X. i ={f i ,si i ,di i ,sm i ,dm i ,t i}, where f i The signal S representing the i-th data item i The frequency, si i Di represents the source IP address of the i-th data item. i sm represents the destination IP of the i-th data item. i dm represents the source MAC address of the i-th data item. i Let t represent the destination MAC address of the i-th data item. i This indicates the acquisition time of the i-th data item. If the MAC address does not exist in the network data carried by the signal, the MAC connection is empty.

[0057] Before storing network data in the database, it needs to be sorted according to the index term {f i ,si i ,dii ,sm i ,dm i Compare with historical datasets; if the network data does not exist in the database, store it in the database; if it already exists in the database, update the collection time t. i .

[0058] S330, Signal Communication Analysis

[0059] Based on the IP and MAC characteristics of the target signal, the communication relationship between signals is determined according to the pairing relationship of IP or MAC connections.

[0060] One implementation method employs a signal communication analysis method based on IP connections. An IP connection for a target signal is selected, denoted as {IPA, IPB}, where IPA is the source IP address and IPB is the destination IP address. A database is searched for multiple frequency band signals with opposite IP connection relationships, where the opposite IP connections are denoted as {IPB, IPA}. If a frequency band signal has more than a preset number of opposite IP connections (e.g., more than 5 pairs), then the frequency band signal is determined to have a communication relationship with the target signal.

[0061] In this embodiment, the preset logarithm is a value greater than 1. Only when a signal in a certain frequency band has more than the preset logarithm of opposite IP connections is it determined that the signal in that frequency band has a communication relationship with the target signal. This can improve the reliability of the determination result.

[0062] Another implementation method is to use a signal communication analysis method based on MAC connections. A target signal's MAC connection is selected, denoted as {MACA, MACB}, where MACA is the source MAC and MACB is the destination MAC. A database is searched for multi-band signals with opposite MAC connection relationships, where opposite MAC connections are denoted as {MACB, MACA}. If a signal in a certain frequency band has at least one pair of opposite MAC connections, it is determined that the signal in that frequency band has a communication relationship with the target signal.

[0063] S340, Signal Correlation Analysis

[0064] Based on the IP and MAC characteristics of the target signal, the correlation between signals is determined according to the overlap of IP or MAC addresses.

[0065] One implementation method is to use a signal association analysis method based on IP addresses. A source IP address of a target signal is selected, and a database is searched for multiple frequency band signals with the same source IP address. If a frequency band signal has more than a first preset number of identical source IP addresses (e.g., more than 10), then the frequency band signal is determined to be associated with the target signal. Alternatively, an IP connection of a target signal is selected, and a database is searched for multiple frequency band signals with the same IP connection characteristics. If a frequency band signal has more than a second preset number of identical IP connections (e.g., more than 5), then the frequency band signal is determined to be associated with the target signal.

[0066] It should be noted that both the first and second preset quantities are empirical values, and the first preset quantity is generally set to twice the second preset quantity. Only when a signal in a certain frequency band has more than the first preset quantity of identical source IP addresses, or more than the second preset quantity of identical IP connections, is it determined that the signal in that frequency band is correlated with the target signal, thus improving the reliability of the determination results.

[0067] Another approach is to use a signal correlation analysis method based on MAC addresses. A source MAC address of a target signal is selected, and a database is searched for multiple frequency band signals with the same source MAC address. If at least one signal in a particular frequency band has the same source MAC address, then that frequency band signal is determined to be correlated with the target signal.

[0068] S350, signal platform association

[0069] Based on the signal correlation analysis results, different mutually correlated signals are assigned to the same platform.

[0070] In this embodiment, different target signals that are mutually related are assigned to the same platform through signal correlation analysis, and it is determined that the related signals are all issued by the same platform.

[0071] S360, Platform Attribute Speculation

[0072] Based on the relationship between the signal and the platform, the platform attribute is inferred from one of the determined signal attributes.

[0073] In this embodiment, based on the relationship between the signal and the platform, the platform attribute of the signal can be inferred according to the platform-related attributes of the signal. If multiple signals are known to be emitted from the same platform, and the platform-related attributes of one of the signals are known, then that attribute is the platform attribute. If signal analysis shows that the signal conforms to the characteristics of a ground-based platform transmitting a signal, then the platform attribute is a ground-based platform.

[0074] S370, Platform Topology Acquisition

[0075] Based on the platform to which the signal belongs and the signal connectivity relationships, the connectivity relationships between the platforms to which the signals belong are derived from these relationships. In other words, for multiple frequency band signals on the same platform, if one signal has a connectivity relationship with a signal on another platform, then it is determined that those two platforms also have a connectivity relationship. For example, if signals SA and SB are a pair of signals with a connectivity relationship, then the platform to which signal SA belongs also has a connectivity relationship with the platform to which signal SB belongs. This is how the topological relationships between the platforms to which the target signal belongs are obtained.

[0076] S380, Multi-band Communication Mining

[0077] This step involves inferring the possible communication relationships between multiple frequency bands, such as shortwave, VHF, and satellite signals, based on the topological relationships between the platforms to which the target signal belongs.

[0078] Specifically, for all MAC addresses and IP addresses of signals in different frequency bands on the same platform, based on the topological relationship between the platforms, for two platforms with communication relationships, all MAC pairs are obtained by pairwise combination according to MAC addresses, or all IP pairs are obtained by pairwise combination according to IP addresses. MAC pairs or IP pairs that already have communication relationships are excluded, and it is speculated that MAC pairs or IP pairs that have not yet appeared between signals in different frequency bands may have communication relationships.

[0079] For example, there are two MAC pairs with communication relationships between platform PE and platform PF: {MAC1, MAC3} and {MAC2, MAC4}. MAC1 and MAC2 are the MAC addresses of platform PE, and MAC3 and MAC4 are the MAC addresses of platform PF. Excluding the existing MAC pairs, there are still two other MAC connection relationships: {MAC1, MAC4} and {MAC2, MAC3}. Based on the communication relationships of the existing MAC connection pairs, it is known that platform PE and platform PF have a communication relationship. Therefore, it is inferred that {MAC1, MAC4} and {MAC2, MAC3}, which do not currently exist between signals in different frequency bands, also have a communication relationship.

[0080] For example, there are three IP pairs with communication relationships between the platform PE and the platform PF: {IP1, IP3}, {IP2, IP4}, and {IP5, IP6}. IP1, IP2, and IP5 are the IP addresses of the platform PE, and IP3, IP4, and IP6 are the IP addresses of the platform PF. Excluding these three known IP pairs, there are still six other IP pair relationships: {IP1, IP4}, {IP2, IP3}, {IP5, IP3}, {IP1, IP6}, {IP2, IP6}, and {IP5, IP4}. Based on the existing IP pair communication relationships, it can be known that the platform PE and platform PF have a communication relationship. Therefore, it is inferred that {IP1, IP4}, {IP2, IP3}, {IP5, IP3}, {IP1, IP6}, {IP2, IP6}, and {IP5, IP4}, which do not currently exist between signals in different frequency bands, also have a communication relationship.

[0081] Therefore, the network electrical feature acquisition method based on network data fusion proposed in this invention can be used to mine network electrical feature information such as target attributes and behavioral relationships in wireless communication networks. By analyzing signal connectivity and signal correlation, platform correlation is performed, and platform topology relationships are obtained, further inferring possible connectivity relationships between signals in multiple frequency bands. This invention effectively solves the problems of signal connectivity, platform correlation, and connectivity inference in communication systems, and features flexible connectivity analysis methods, novel signal correlation methods, and intuitive platform topology analysis.

[0082] Similar to the aforementioned methods, this invention also provides a network electrical feature acquisition device based on network data fusion. Figure 6 This is a schematic diagram of a network-electricity feature acquisition device based on network data fusion proposed in this invention. See [link / reference]. Figure 6 As shown, the grid power feature acquisition device of the present invention includes:

[0083] The signal interception module 610 is used to intercept multiple target signals from multiple frequency band signals detected;

[0084] Feature extraction module 620 is used to extract network feature information for each target signal, the network feature information including IP address and / or MAC address;

[0085] The communication relationship acquisition module 630 is used to acquire the communication relationship of each target signal based on the pairing relationship of the IP address or MAC address of the target signal;

[0086] The association relationship acquisition module 640 is used to acquire the association relationship of each target signal based on the overlap of the IP address or MAC address of the target signal;

[0087] The platform association module 650 is used to assign different interconnected signals to the same platform.

[0088] Platform attribute acquisition module 660 is used to infer the attributes of the platform based on the platform attributes of one of the known signals, and to acquire the platform attributes of each target signal;

[0089] The platform topology acquisition module 670 is used to acquire the topological relationship between the platforms to which the target signal belongs, based on the platform attributes and communication relationships of each target signal;

[0090] The communication relationship prediction module 680 is used to predict the possible communication relationships between signals of different frequency bands based on the topological relationship between the platforms to which the target signal belongs.

[0091] Specifically, the feature extraction module 620 is used to: extract the source IP address, destination IP address, source MAC address, and destination MAC address of the target signal from the network data packets carried by the target signal; obtain the IP connection of the target signal based on the source IP address minus the destination IP address; obtain the MAC connection of the target signal based on the source MAC address minus the destination MAC address; and store the frequency, source IP address, destination IP address, source MAC address, destination MAC address, and acquisition time of the target signal as an analysis object in the database.

[0092] Specifically, the communication relationship acquisition module 630 is used to: select an IP connection of a target signal, whose IP connection is set as {IPA, IPB}, where IPA is the source IP address and IPB is the destination IP address; search the database for multiple frequency band signals with opposite IP connection relationships, where the opposite IP connections are {IPB, IPA}; if a frequency band signal has more than a preset number of opposite IP connections, it is determined that the frequency band signal has a communication relationship with the target signal.

[0093] Alternatively, the communication relationship acquisition module 630 is specifically used to: select a target signal's MAC connection, which is set as {MACA, MACB}, where MACA is the source MAC address and MACB is the destination MAC address; search the database for multiple frequency band signals with opposite MAC connection relationships, where the opposite MAC connections are {MACB, MACA}; if a frequency band signal has at least one pair of opposite MAC connections, then it is determined that the frequency band signal has a communication relationship with the target signal.

[0094] Specifically, the association acquisition module 640 is used to: select the source IP address of a target signal, search the database for multiple frequency band signals with the same source IP address characteristics, and if a frequency band signal has more than a first preset number of identical source IP addresses, then determine that the frequency band signal has an association relationship with the target signal; or, select the IP connection of a target signal, search the database for multiple frequency band signals with the same IP connection characteristics, and if a frequency band signal has more than a second preset number of identical IP connections, then determine that the frequency band signal has an association relationship with the target signal.

[0095] Alternatively, the association acquisition module 640 is specifically used to: select the source MAC address of a target signal, search for multiple frequency band signals with the same source MAC address in the database, and if a frequency band signal has at least one same source MAC address, then determine that the frequency band signal has an association with the target signal.

[0096] Specifically, the platform topology acquisition module 670 is used to: for multiple frequency band signals of the same platform, if one of the signals has a communication relationship with the signals of other platforms, then determine that the two platforms also have a communication relationship, thereby obtaining the topology relationship between the platforms to which the target signal belongs.

[0097] Specifically, the communication relationship prediction module 680 is used to: for all MAC addresses and IP addresses of signals in different frequency bands on the same platform, based on the topology between the platforms, for two platforms with communication relationships, combine them in pairs according to MAC addresses to obtain all MAC pairs, or combine them in pairs according to IP addresses to obtain all IP pairs, exclude MAC pairs or IP pairs that already have communication relationships, and predict MAC pairs or IP pairs that have not yet appeared between signals in different frequency bands that may have communication relationships.

[0098] The implementation process of each unit module in the grid power feature acquisition device of the present invention can be found in the foregoing method embodiments, and will not be repeated here.

[0099] In addition to the aforementioned methods and apparatus, which belong to the same technical concept, this invention also provides an electronic device. Figure 7 This is a schematic diagram of the structure of an electronic device proposed in this invention. See also... Figure 7 The electronic device proposed in this invention includes a memory and a processor. The memory can be RAM, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk storage device. The memory stores a computer program, which is loaded and executed by the processor to implement the aforementioned method for obtaining network electrical features based on network data fusion.

[0100] like Figure 7 As shown, at the hardware level, this electronic device may optionally include: a display panel, an interface module, a communication module, and other hardware. The memory, processor, display panel, interface module, and communication module can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 7 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0101] Those skilled in the art will understand that the various embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or a combination of software and hardware embodiments. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer programs.

[0102] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0103] The above are merely embodiments of the present invention and are not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

Claims

1. A method for obtaining network electrical features based on network data fusion, characterized in that, include: Multiple target signals were intercepted from multiple frequency band signals; Extract the network feature information of each target signal, the network feature information including IP address and / or MAC address; Based on the pairing relationship of the IP address or MAC address of the target signal, obtain the communication relationship of each target signal; Based on the overlap of IP addresses or MAC addresses of the target signals, obtain the correlation relationship of each target signal; Different interconnected signals are assigned to the same platform, and the platform attributes are inferred based on the platform attributes of one of the known signals to obtain the platform attributes of each target signal. Based on the platform attributes and communication relationships of each target signal, obtain the topological relationships between the platforms to which the target signal belongs; Based on the topological relationship between the platforms to which the target signal belongs, infer the possible communication relationships between signals in different frequency bands; The step of inferring possible communication relationships between signals in different frequency bands based on the topological relationships between the platforms to which the target signal belongs includes: For all MAC addresses and IP addresses of signals in different frequency bands on the same platform, based on the topology between platforms, for two platforms with communication relationships, all MAC pairs are obtained by pairwise combination of MAC addresses, or all IP pairs are obtained by pairwise combination of IP addresses. MAC pairs or IP pairs that already have communication relationships are excluded, and it is speculated that MAC pairs or IP pairs that have not yet appeared between signals in different frequency bands may have communication relationships.

2. The method according to claim 1, characterized in that, The extraction of network feature information for each target signal, including IP address and / or MAC address, includes: Extract the source IP address, destination IP address, source MAC address, and destination MAC address of the target signal from the network data packets carried by the target signal. Obtain the IP connection of the target signal based on the source IP address minus the destination IP address, and obtain the MAC connection of the target signal based on the source MAC address minus the destination MAC address. The frequency of the target signal, source IP address, target IP address, source MAC address, target MAC address, and acquisition time are stored as an analysis object in the database.

3. The method according to claim 2, characterized in that, The step of obtaining the communication relationship of each target signal based on the pairing relationship of the target signals' IP addresses includes: Select an IP connection for a target signal, and set its IP connection to... ,in, The source IP address The destination IP address; Search the database for multiple frequency band signals with opposite IP connections, where the opposite IP connections are: ; If a signal in a certain frequency band has more than a preset number of opposite IP connections, it is determined that the signal in that frequency band is connected to the target signal.

4. The method according to claim 2, characterized in that, The step of obtaining the communication relationship of each target signal based on the pairing relationship of the MAC addresses of the target signals includes: Select the MAC connection of a target signal, and set its MAC connection to... ,in, Source MAC address The destination MAC address; Search the database for multiple frequency band signals with opposite MAC connections, where the opposite MAC connections are: ; If a signal in a certain frequency band has at least one pair of opposite MAC connections, it is determined that the signal in that frequency band is connected to the target signal.

5. The method according to claim 2, characterized in that, The step of obtaining the association relationship of each target signal based on the overlap of their IP addresses includes: Select the source IP address of a target signal, search the database for multiple frequency band signals with the same source IP address feature. If a frequency band signal has more than a first preset number of signals with the same source IP address, it is determined that the frequency band signal is associated with the target signal. Alternatively, select an IP connection of a target signal, search the database for multiple frequency band signals with the same IP connection characteristics, and if a frequency band signal has more than a second preset number of identical IP connections, then determine that the frequency band signal is associated with the target signal.

6. The method according to claim 2, characterized in that, The step of obtaining the correlation relationship of each target signal based on the overlap of their MAC addresses includes: Select the source MAC address of a target signal, search the database for multiple frequency band signals with the same source MAC address characteristics. If a frequency band signal has at least one source MAC address, it is determined that the frequency band signal is associated with the target signal.

7. The method according to any one of claims 1-6, characterized in that, The step of obtaining the topological relationship between the platforms to which the target signal belongs based on the platform attributes and communication relationships of each target signal includes: For multiple frequency band signals on the same platform, if one of the signals has a communication relationship with the signals of other platforms, then it is determined that there is also a communication relationship between the two platforms, thereby obtaining the topological relationship between the platforms to which the target signal belongs.

8. A device for acquiring network characteristics based on network data fusion, characterized in that, include: The signal interception module is used to intercept multiple target signals from multiple frequency band signals. The feature extraction module is used to extract network feature information for each target signal, including IP address and / or MAC address; The communication relationship acquisition module is used to acquire the communication relationship of each target signal based on the pairing relationship of the target signal's IP address or MAC address; The association relationship acquisition module is used to obtain the association relationship of each target signal based on the overlap of the IP address or MAC address of the target signal; The platform association module is used to assign different related signals to the same platform; The platform attribute acquisition module is used to infer the attributes of the platform based on the platform attributes of one of the known signals, and to acquire the platform attributes of each target signal. The platform topology acquisition module is used to acquire the topological relationship between the platforms to which the target signal belongs, based on the platform attributes and communication relationships of each target signal; The communication relationship inference module is used to infer the possible communication relationships between signals in different frequency bands based on the topological relationship between the platforms to which the target signal belongs. The communication relationship inference module is specifically used for: For all MAC addresses and IP addresses of signals in different frequency bands on the same platform, based on the topology between platforms, for two platforms with communication relationships, all MAC pairs are obtained by pairwise combination of MAC addresses, or all IP pairs are obtained by pairwise combination of IP addresses. MAC pairs or IP pairs that already have communication relationships are excluded, and it is speculated that MAC pairs or IP pairs that have not yet appeared between signals in different frequency bands may have communication relationships.

9. An electronic device, comprising a memory and a processor, The memory stores a computer program, which is loaded and executed by the processor to implement the network electrical feature acquisition method based on network data fusion as described in any one of claims 1-7.

Images