Power terminal device fingerprint generation method and device, electronic device, and storage medium

Abstract

The application discloses a power terminal device fingerprint generation method and device, electronic equipment and a storage medium, comprising: obtaining network data flow of power terminal device access and server communication; data preprocessing is carried out on the network data flow based on the IP address of the data packet in the network data flow, and a preprocessing result is obtained; a Huffman tree is constructed based on the preprocessing result; and the fingerprint of the power terminal device is generated based on the pruning result of the Huffman tree. Through the implementation of the application, the fingerprint characteristics of the power terminal device are directly extracted from the network data flow, which is more suitable for real network environment with huge network data flow; the original network flow is divided into network flow segments based on the IP address, the fine-grained fingerprint characteristics can be obtained, and the reliability of power terminal device identity authentication is strengthened; and the problem that the accuracy of the generated device fingerprint cannot be guaranteed due to the use of coarse-grained characteristics is avoided.

Description

Technical Field

[0001] The present invention relates to the field of terminal identification security technology, and in particular to a method, device, electronic device and storage medium for generating fingerprints of power terminal equipment. Background Art

[0002] With the construction of new power systems, the position of flexible distributed resource control services in the construction of new power systems is becoming increasingly important. A large number of terminals such as various distributed power sources, energy storage, and loads are connected to the power grid, and the impact and challenges faced by the safe operation of the power system have increased significantly. How to correctly identify the identity of the access terminal and prevent the access of illegal terminal equipment is the primary issue.

[0003] Real-world power grid scenarios generate massive amounts of raw network traffic, containing numerous data packets that often contain valuable information. However, most current methods for detecting abnormal terminals can only analyze features generated by specific systems and cannot directly extract features from raw network traffic. Some detection methods can directly analyze raw network traffic, but only extract coarse-grained features for a single terminal. Summary of the Invention

[0004] In view of this, an embodiment of the present invention provides a method, apparatus, electronic device and storage medium for generating fingerprints of power terminal equipment to solve the technical problem in the prior art that the accuracy of device fingerprints generated by extracting coarse-grained features based on original network traffic cannot be guaranteed.

[0005] The technical solutions proposed by the present invention are as follows:

[0006] A first aspect of an embodiment of the present invention provides a method for generating a fingerprint of a power terminal device, comprising: obtaining network data traffic that the power terminal device communicates with a server when accessing the power terminal device; performing data preprocessing on the network data traffic based on the IP address of a data packet in the network data traffic to obtain a preprocessing result; constructing a Huffman tree based on the preprocessing result; and generating a fingerprint of the power terminal device based on a pruning result of the Huffman tree.

[0007] Optionally, data preprocessing is performed on the network data traffic based on the IP addresses of the data packets in the network data traffic to obtain a preprocessing result, including: dividing the network data traffic based on the IP addresses of the data packets in the network data traffic to obtain multiple network traffic segments; forming a representation sequence of the network traffic segments according to the labels corresponding to the message types of the data packets in each network traffic segment; and calculating the average utility of each network traffic segment based on the representation sequence to obtain a preprocessing result.

[0008] Optionally, the network data traffic is divided based on the IP addresses of the data packets of the network data traffic to obtain multiple network traffic fragments, including: obtaining the source IP address and destination IP address of each data packet in the network data traffic; determining whether the source IP address and destination IP address of any two adjacent data packets are the same; when they are not the same, dividing the network data traffic and obtaining multiple traffic fragments according to the division results.

[0009] Optionally, before forming a representation sequence of the network traffic segment according to the label corresponding to the message type of the data packet in each network traffic segment, it includes: obtaining the message type during historical communication between the server and the power terminal device; and generating a label corresponding to each message type.

[0010] Optionally, the average utility of each network traffic segment is calculated based on the representation sequence, including: based on the representation sequence, using the TF-IDF algorithm to calculate the utility of each label in each network traffic segment; calculating the average utility of all labels in each network traffic segment to obtain the average utility of each network traffic segment.

[0011] Optionally, constructing a Huffman tree based on the preprocessing results includes: comparing the average utility of each network traffic segment with a first preset threshold to determine the network traffic segments that are greater than the first preset threshold; and constructing a Huffman tree based on the network traffic segments that are greater than the first preset threshold.

[0012] Optionally, a Huffman tree is constructed based on network traffic segments that are larger than the preset threshold, including: forming a path of the Huffman tree based on network traffic segments that are larger than the preset threshold, with the label in each network traffic segment being a tree node in the path; determining whether there are duplicate nodes between different paths of the Huffman tree; and if there are duplicate nodes, merging the duplicate nodes.

[0013] Optionally, the fingerprint of the power terminal device is generated based on the pruning result of the Huffman tree, including: calculating the average utility of each message type; judging whether the average utility of the message type corresponding to the root node of each path in the Huffman tree is less than a second preset threshold; deleting the root node whose corresponding message type has an average utility less than the second preset threshold, and using the next node of the root node as a new root node, and the average utility of the message type corresponding to the next node is greater than the second preset threshold; merging the remaining paths in the Huffman tree to generate the fingerprint of the power terminal device.

[0014] A second aspect of an embodiment of the present invention provides a fingerprint generation device for a power terminal device, comprising: a traffic acquisition module for acquiring the network data traffic that the power terminal device communicates with the server when accessed; a preprocessing module for performing data preprocessing on the network data traffic based on the IP address of the data packet in the network data traffic to obtain a preprocessing result; a tree construction module for constructing a Huffman tree based on the preprocessing result; and a fingerprint generation module for generating the fingerprint of the power terminal device based on the pruning result of the Huffman tree.

[0015] Optionally, the preprocessing module includes: a division module, used to divide the network data traffic based on the IP addresses of the data packets of the network data traffic to obtain multiple network traffic fragments; a representation module, used to form a representation sequence of the network traffic fragments according to the labels corresponding to the message types of the data packets in each network traffic fragment; and a utility calculation module, used to calculate the average utility of each network traffic fragment based on the representation sequence to obtain a preprocessing result.

[0016] Optionally, the division module is specifically used to: obtain the source IP address and destination IP address of each data packet in the network data traffic; determine whether the source IP address and destination IP address of any two adjacent data packets are the same; when they are not the same, divide the network data traffic and obtain multiple traffic fragments according to the division results.

[0017] Optionally, the preprocessing module further includes: a label generation module, specifically used to obtain message types during historical communications between the server and the power terminal device; and generate a label corresponding to each message type.

[0018] Optionally, the utility calculation module is specifically used to: calculate the utility of each label in each network traffic segment based on the representation sequence using the TF-IDF algorithm; calculate the average utility of all labels in each network traffic segment to obtain the average utility of each network traffic segment.

[0019] Optionally, the tree construction module includes: a comparison module, used to compare the average utility of each network traffic segment with a first preset threshold, and determine the network traffic segments that are greater than the first preset threshold; and a construction module, used to construct a Huffman tree based on the network traffic segments that are greater than the first preset threshold.

[0020] Optionally, the construction submodule is specifically used to: form a path of a Huffman tree based on network traffic segments that are greater than the preset threshold, and the label in each network traffic segment is a tree node in the path; determine whether there are duplicate nodes between different paths of the Huffman tree; if there are duplicate nodes, merge the duplicate nodes.

[0021] Optionally, the fingerprint generation module is specifically used to: calculate the average utility of each message type; determine whether the average utility of the message type corresponding to the root node of each path in the Huffman tree is less than a second preset threshold; delete the root node whose corresponding message type has an average utility less than the second preset threshold, and use the next node of the root node as the new root node, and the average utility of the message type corresponding to the next node is greater than the second preset threshold; merge the remaining paths in the Huffman tree to generate the fingerprint of the power terminal device.

[0022] A third aspect of an embodiment of the present invention provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the power terminal device fingerprint generation method as described in the first aspect of the embodiment of the present invention and any one of the first aspects.

[0023] A fourth aspect of an embodiment of the present invention provides an electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to execute the power terminal device fingerprint generation method as described in the first aspect of the embodiment of the present invention and any one of the first aspects.

[0024] The technical solution provided by the present invention has the following effects:

[0025] The method and device for generating fingerprints of power terminal equipment provided by the embodiments of the present invention directly extract the fingerprint features of the power terminal equipment from the original network traffic, that is, the obtained network data traffic, and are more suitable for real network environments with huge network data traffic; unlike the current method of dividing data streams based on time intervals, which may cause the extracted fingerprints to be incomplete or overlapping, the embodiments of the present invention divide the original network traffic into network traffic segments based on IP addresses, which can obtain fine-grained fingerprint features, enhance the reliability of the identity authentication of the power terminal equipment, and avoid the problem that the accuracy of the generated device fingerprint cannot be guaranteed due to the use of coarse-grained features.

[0026] The power terminal device fingerprint generation method provided by the embodiments of the present invention extracts the message types interacting with the power terminal device to describe the device's behavior and extract the device's fingerprint features, reducing computational complexity and requiring less computing power. Furthermore, a set threshold is used to directly filter out low-utility nodes, preserving high-frequency feature information as much as possible to obtain a highly recognizable feature fingerprint. Furthermore, the average utility of network traffic segments is calculated, and using this as a screening criterion, a high-utility power terminal device fingerprint is generated, further improving the accuracy of power terminal device identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0028] Figure 1 is a flow chart of a method for generating a fingerprint of a power terminal device according to an embodiment of the present invention;

[0029] Figure 2 Schematic diagram of message types that perform different functions included in the TLS protocol in the power terminal device fingerprint generation method according to an embodiment of the present invention;

[0030] Figure 3 2. Schematic diagram of labels for message types that perform different functions in the TLS protocol in the method for generating fingerprints of power terminal equipment according to an embodiment of the present invention;

[0031] Figure 4 2. It is a schematic diagram of a network traffic segment in a method for generating a fingerprint of a power terminal device according to an embodiment of the present invention;

[0032] Figure 5 Schematic diagram of a Huffman tree constructed in a method for generating a fingerprint of a power terminal device according to an embodiment of the present invention;

[0033] Figure 6 is a structural block diagram of a fingerprint generating device for power terminal equipment according to an embodiment of the present invention;

[0034] Figure 7 is a schematic diagram of the structure of a computer-readable storage medium provided according to an embodiment of the present invention;

[0035] Figure 8 is a schematic structural diagram of an electronic device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0037] The terms "first," "second," "third," "fourth," and the like in the specification and claims of the present invention and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0038] According to an embodiment of the present invention, a method for generating a fingerprint of a power terminal device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0039] In this embodiment, a method for generating fingerprints of power terminal equipment is provided, which can be used in electronic devices such as computers, mobile phones, tablet computers, etc. Figure 1 FIG. 1 is a flow chart of a method for generating fingerprints of power terminal equipment according to an embodiment of the present invention. Figure 1 As shown, the method includes the following steps:

[0040] Step S101: Obtain the network data traffic of the power terminal device communicating with the server when it is connected.

[0041] Specifically, when a power terminal device requests access from a server, the server can intercept the network data traffic between the power terminal device and the server for a period of time through bypass monitoring, thereby obtaining network data traffic. The bypass monitoring method uses the switch's mirroring function to achieve monitoring. This means that through the shared hub or mirroring switch's own functions, a copy of the outbound data is copied to the port connected to the monitoring host, achieving the purpose of monitoring.

[0042] Obtaining network traffic through bypass monitoring offers the following advantages: First, it's easy to install and operate. Deployment in bypass monitoring mode is flexible and convenient, requiring only the configuration of a mirrored port on the switch, without disrupting the existing network structure. It also provides fast response times. Second, bypass mode analyzes data copied from the mirrored port, without delaying the original transmitted data packets and impacting network speeds. Third, it does not affect normal Internet access. A failure or interruption of the bypass monitoring software will not impact the existing network.

[0043] Step S102: performing data preprocessing on the network data traffic based on the IP addresses of the data packets in the network data traffic to obtain a preprocessing result.

[0044] Specifically, the n-gram model can be used to implement preprocessing. The n-gram model is an algorithm based on a statistical language model. Its input is a sentence (a sequence of words), and its output is the probability of that sentence, or the joint probability of its words. The basic idea is to apply a sliding window of size N to the text content, forming a sequence of byte segments of length N. Each byte segment is called a gram. The frequency of occurrence of all grams is counted and filtered according to a pre-set threshold to form a list of key grams, which is the vector feature space of the text. Each gram in the list represents a feature vector dimension.

[0045] This embodiment primarily draws on the concept of the n-gram model when processing network data traffic. During preprocessing, network data traffic is segmented according to the n-gram model's processing flow, and frequency statistics are then performed on the segmented traffic. During traffic segmentation, the original network traffic, i.e., network data traffic, is segmented using IP addresses to obtain multiple network traffic segments.

[0046] Step S103: constructing a Huffman tree based on the preprocessing result.

[0047] In this embodiment, the n-gram model concept is also used when constructing the Huffman tree based on the preprocessing result, that is, when forming the Huffman tree, the divided traffic is filtered by a preset threshold value. The Huffman tree is generated based on the filtered traffic.

[0048] Step S104: generating a fingerprint of the power terminal device based on the pruning result of the Huffman tree.

[0049] Specifically, a Huffman tree is generated for each power terminal device's network data traffic. After pruning the tree, all nodes in the tree are merged to obtain the fingerprint of the power terminal device. This fingerprint can be used as the identifier of the power terminal device for subsequent identification, thereby ensuring secure access to the power terminal device.

[0050] The power terminal device fingerprint generation method provided by the embodiment of the present invention directly extracts the fingerprint features of the power terminal device from the original network traffic, that is, the obtained network data traffic, and is more suitable for real network environments with huge network data traffic; unlike the current method of dividing data streams based on time intervals, which may cause the extracted fingerprints to be incomplete or overlapping, the embodiment of the present invention divides the original network traffic into network traffic segments based on IP addresses, which can obtain fine-grained fingerprint features and enhance the reliability of the identity authentication of the power terminal device; and avoids the problem that the accuracy of the generated device fingerprint cannot be guaranteed due to the use of coarse-grained features. In addition, by incorporating the idea of ​​the n-gram model, sequence features containing the relationship between the previous and next elements can be extracted to obtain more accurate fingerprint feature information, further improving the accuracy of the identification of the power terminal device.

[0051] In one embodiment, performing data preprocessing on the network data traffic based on the IP addresses of the data packets in the network data traffic to obtain a preprocessing result includes the following steps:

[0052] Step S201: The network data flow is divided based on the IP addresses of the packets in the network data flow to obtain a plurality of network data flow segments. During the division, the source IP address and destination IP address of each packet in the network data flow are first obtained; a determination is made as to whether the source IP addresses and destination IP addresses of any two adjacent packets are the same; if they are not the same, the network data flow is divided, and a plurality of traffic segments are obtained based on the division results.

[0053] Specifically, when dividing the network data traffic, the traffic is divided based on the basic attributes in the data packet, namely the source IP address and the destination IP address. IAT ={p1,p2,Λ,p i ,p j ,Λ,p N}, which includes multiple data packets p i Each data packet has an attribute IP address pair {IP src ,IP dst}, if two adjacent data packets pi, p j The IP address pair {IP src ,IP dst}, then in the adjacent data packet p i 、p jNetwork traffic is divided into two segments. A sequential swap of source and destination IP addresses is not considered a change in IP addresses. During actual segmentation, the IP addresses of any two adjacent packets in the network traffic are compared. If the IP addresses change, the traffic is segmented between the two packets. As a result, the network traffic may be divided into multiple segments.

[0054] Step S202: Form a representation sequence for each network traffic segment based on the label corresponding to the message type of the data packet in each network traffic segment. Specifically, to facilitate subsequent analysis of each network traffic segment, this embodiment uses the label corresponding to the message type of the data packet to represent each network traffic segment, thereby forming a representation sequence for each network traffic segment. It should be noted that when using labels to represent the data packets in the network traffic segment, the labels in the network traffic segment are arranged in the order of the data packets to form a representation sequence.

[0055] Step S203: Calculate the average utility of each network traffic segment based on the representation sequence to obtain a preprocessing result. Specifically, when calculating the average utility of the network traffic segment, the utility of each tag in the network traffic segment can be calculated first, and then the average utility is calculated as the preprocessing result.

[0056] In one embodiment, before forming a representation sequence of network traffic segments based on the labels corresponding to the message types of the data packets in each network traffic segment, the method includes: obtaining the message types during historical communications between the server and the power terminal device; and generating labels corresponding to each message type. Specifically, during the communication process between the power terminal device and the server, different messages are transmitted at different stages. Each message has a specific format and is used to perform different functions. The diversity of messages during the communication process makes it possible to extract fingerprint features. Thus, by calculating the utility of the network traffic segments represented by the labels corresponding to the message types of the data packets, the fingerprint of the power terminal device formed can be used to identify the power terminal device.

[0057] Among them, in order to obtain all message types used in the communication process, the message types in the historical communication process between the server and other power terminal devices of the same or different types can be obtained. When obtaining the message type, the corresponding message type can be obtained based on the communication protocol. For example, the message types included in the TLS protocol that perform different functions are as follows: Figure 2 shown.

[0058] In order to distinguish different message types, different labels are used to represent different message types, which is convenient for description and subsequent fingerprint generation. Figure 3 As shown, the labels in the rightmost column mark the message types that perform different functions in the TLS protocol.

[0059] In one embodiment, the average utility of each network traffic segment is calculated based on the representation sequence, including: based on the representation sequence, using the TF-IDF algorithm to calculate the utility of each tag in each network traffic segment; calculating the average utility of all tags in each network traffic segment to obtain the average utility of each network traffic segment.

[0060] TF-IDF (term frequency–inverse document frequency) is a common weighting technique used in information retrieval and text mining. TF-IDF is a statistical method used to assess the importance of a term to a document in a collection of documents or a corpus. The importance of a term increases with the number of times it appears in a document, but decreases inversely with its frequency in the corpus. Various forms of TF-IDF weighting are often used by search engines as a measure or rating of the relevance of documents to user queries. In addition to TF-IDF, search engines on the Internet also use ranking methods based on link analysis to determine the order in which documents appear in search results.

[0061] TF-IDF is actually: TF*IDF, where TF stands for term frequency and IDF stands for inverse document frequency. Within a given document, term frequency refers to how often a given term appears within that document. This number normalizes the word count to prevent it from being biased towards long documents. (The same word may have a higher word count in a long document than in a short document, regardless of its importance.) For a term in a particular document, its importance can be expressed as:

[0062]

[0063] where n i,j Is the word in file d j The denominator is the number of occurrences in file d j The sum of the occurrences of all words in .

[0064] Inverse Document Frequency (IDF) is a measure of the general importance of a term. The IDF of a particular term can be calculated by dividing the total number of documents by the number of documents containing the term and taking the base 10 logarithm of the quotient:

[0065]

[0066] where |D| is the total number of documents in the corpus, |{j:t i ∈dj}| means containing word t i The number of documents (i.e., the number of documents ≠ 0). If the word is not in the data, the denominator will be zero. Therefore, 1+|{j:t i ∈d j}|. From this we get:

[0067] tfidf i,j =tf i,j ×idf i

[0068] A high word frequency within a particular document, combined with a low word frequency across the entire document collection, can result in a high TF-IDF weight. Therefore, TF-IDF tends to filter out common words and retain important words.

[0069] Based on the above TF-IDF algorithm, the utility of each label in each network traffic segment can be calculated according to the following formula:

[0070]

[0071] Where, sequence s= <p1,p2,Λ,p i ,Λ,p n > Middle label p i The number of The length of sequence s is n, and p i The ratio is tf(n pi ,n); the total number of network traffic segments obtained by division is n f , containing the message p i The number of network traffic fragments is

[0072] When calculating the average utility, the utility of each label is averaged, that is, the average utility is expressed as:

[0073]

[0074] In one embodiment, constructing a Huffman tree based on the preprocessing results includes: comparing the average utility of each network traffic segment with a first preset threshold value to determine network traffic segments that are greater than the first preset threshold value; and constructing a Huffman tree based on network traffic segments that are greater than the first preset threshold value. Specifically, the first preset threshold value is a pre-set minimum threshold value for average utility. If the calculated average utility of a network traffic segment is less than the first preset threshold value, it indicates that the network traffic segment is not very useful in distinguishing the power terminal device from other power terminal devices, and the network traffic segment is directly discarded. Network traffic segments with an average utility greater than the first preset threshold value are added to the path of the Huffman tree.

[0075] In one embodiment, a Huffman tree is constructed based on network traffic segments greater than a preset threshold, including: forming a path in the Huffman tree based on the network traffic segments greater than the preset threshold, with the label in each network traffic segment being a tree node in the path; determining whether there are duplicate nodes between different paths in the Huffman tree; and merging the duplicate nodes if there are duplicate nodes. Specifically, when adding a network traffic segment to a path in the Huffman tree, each label in a representation sequence corresponding to the network traffic segment corresponds to a tree node in the path. If the representation sequences corresponding to different network traffic segments have duplicate portions, the paths may be merged.

[0076] For example, the network traffic segments obtained by dividing the network data traffic of a certain power terminal device are as follows: Figure 4 As shown, the Huffman tree obtained by adding paths and merging paths is as follows Figure 5 shown.

[0077] In one embodiment, the fingerprint of the power terminal device is generated based on the pruning result of the Huffman tree, including: calculating the average utility of each message type; judging whether the average utility of the message type corresponding to the root node of each path in the Huffman tree is less than a second preset threshold; deleting the root node whose corresponding message type has an average utility less than the second preset threshold, and using the next node of the root node as a new root node, and the average utility of the message type corresponding to the next node is greater than the second preset threshold; merging the remaining paths in the Huffman tree to generate the fingerprint of the power terminal device.

[0078] Specifically, for a given message type p in a certain power terminal device and all network traffic segments {s1,s2,Λ,s l}, the average utility of each message type in all network traffic segments is calculated using the following formula:

[0079]

[0080] Where, is the utility sum of packets with message type p in the network traffic segment si, sum(p) is the total number of packets with message type p in all network traffic segments. It can be determined by summing the utilities of each tag calculated above with the message type p.

[0081] When pruning the Huffman tree, low-utility nodes are removed based on the calculated average utility of each message type. During removal, the average utility of the message type corresponding to each root node in the Huffman tree is compared with a second preset threshold. If it is lower than the second preset threshold, the root node is deleted, and the next node of the root node is determined. If the average utility of the message type corresponding to the next node is also lower than the second preset threshold, the next node is also deleted. The next node is then determined again (the next node is the next node of the next node) until the average utility of the message type corresponding to the node is greater than the second preset threshold. At this point, the node is used as the new root node. The root node is determined without considering the intermediate nodes to ensure the integrity of the fingerprint of the power terminal device. That is, the nodes in the middle of the tree cannot be deleted, only the root node. For the pruned Huffman tree with the nodes deleted, the remaining path nodes are merged to obtain the fingerprint of the power terminal device. That is, the fingerprint of the power terminal device is generated by merging multiple representation sequences.

[0082] The power terminal device fingerprint generation method provided by an embodiment of the present invention extracts the message types interacting with the power terminal device to describe the device behavior and extract the device's fingerprint features, which reduces computational complexity and requires less computing power from the device. Simultaneously, a set threshold is used to directly filter low-utility nodes, retaining high-frequency feature information as much as possible to obtain a feature fingerprint with high recognition capability. Furthermore, the average utility of network traffic segments is calculated based on the n-gram model, and high-utility power terminal device fingerprints are generated using utility as a screening criterion, further improving the accuracy of power terminal device identification.

[0083] The embodiment of the present invention also provides a fingerprint generating device for power terminal equipment, such as Figure 6 As shown, the device includes:

[0084] The traffic acquisition module is used to obtain the network data traffic of the power terminal device communicating with the server when it is connected; the specific content can be found in the corresponding part of the above method embodiment, which will not be repeated here.

[0085] The preprocessing module is used to perform data preprocessing on the network data traffic based on the IP address of the data packet in the network data traffic to obtain a preprocessing result; for the specific content, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0086] The tree construction module is used to construct a Huffman tree based on the preprocessing result; the specific content can be found in the corresponding part of the above method embodiment, which will not be repeated here.

[0087] The fingerprint generation module is used to generate the fingerprint of the power terminal device based on the pruning result of the Huffman tree. For details, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0088] The power terminal equipment fingerprint generation device provided by the embodiment of the present invention directly extracts the fingerprint features of the power terminal equipment from the original network traffic, that is, the obtained network data traffic, and is more suitable for real network environments with huge network data traffic; unlike the current method of dividing data streams based on time intervals, which may cause the extracted fingerprints to be incomplete or overlapping, the embodiment of the present invention divides the original network traffic into network traffic segments based on IP addresses, which can obtain fine-grained fingerprint features and enhance the reliability of the identity authentication of the power terminal equipment; by incorporating the idea of ​​the n-gram model, it can extract sequence features containing the relationship between the previous and next elements, obtain more accurate fingerprint feature information, and further improve the accuracy of identifying the power terminal equipment.

[0089] For a detailed description of the functions of the power terminal device fingerprint generation device provided in the embodiment of the present invention, please refer to the description of the power terminal device fingerprint generation method in the above embodiment.

[0090] Optionally, the preprocessing module includes: a division module, used to divide the network data traffic based on the IP addresses of the data packets of the network data traffic to obtain multiple network traffic fragments; a representation module, used to form a representation sequence of the network traffic fragments according to the labels corresponding to the message types of the data packets in each network traffic fragment; and a utility calculation module, used to calculate the average utility of each network traffic fragment based on the representation sequence to obtain a preprocessing result.

[0091] Optionally, the division module is specifically used to: obtain the source IP address and destination IP address of each data packet in the network data traffic; determine whether the source IP address and destination IP address of any two adjacent data packets are the same; when they are not the same, divide the network data traffic and obtain multiple traffic fragments according to the division results.

[0092] Optionally, the preprocessing module further includes: a label generation module, specifically used to obtain message types during historical communications between the server and the power terminal device; and generate a label corresponding to each message type.

[0093] Optionally, the utility calculation module is specifically used to: calculate the utility of each label in each network traffic segment based on the representation sequence using the TF-IDF algorithm; calculate the average utility of all labels in each network traffic segment to obtain the average utility of each network traffic segment.

[0094] Optionally, the tree construction module includes: a comparison module, used to compare the average utility of each network traffic segment with a first preset threshold, and determine the network traffic segments that are greater than the first preset threshold; and a construction module, used to construct a Huffman tree based on the network traffic segments that are greater than the first preset threshold.

[0095] Optionally, the construction submodule is specifically used to: form a path of a Huffman tree based on network traffic segments that are greater than the preset threshold, and the label in each network traffic segment is a tree node in the path; determine whether there are duplicate nodes between different paths of the Huffman tree; if there are duplicate nodes, merge the duplicate nodes.

[0096] Optionally, the fingerprint generation module is specifically used to: calculate the average utility of each message type; determine whether the average utility of the message type corresponding to the root node of each path in the Huffman tree is less than a second preset threshold; delete the root node whose corresponding message type has an average utility less than the second preset threshold, and use the next node of the root node as the new root node, and the average utility of the message type corresponding to the next node is greater than the second preset threshold; merge the remaining paths in the Huffman tree to generate the fingerprint of the power terminal device.

[0097] The embodiment of the present invention also provides a storage medium, such as Figure 7 As shown, a computer program 601 is stored thereon, and when the instructions are executed by the processor, the steps of the power terminal device fingerprint generation method in the above embodiment are implemented. The storage medium also stores audio and video stream data, feature frame data, interaction request signaling, encrypted data, and preset data size. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk drive (HDD) or a solid-state drive (SSD); the storage medium can also include a combination of the above types of memory.

[0098] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD). The storage medium can also include a combination of the above-mentioned types of memory.

[0099] The embodiment of the present invention further provides an electronic device, such as Figure 8As shown, the electronic device may include a processor 51 and a memory 52, wherein the processor 51 and the memory 52 may be connected via a bus or other means. Figure 8 The bus connection is taken as an example.

[0100] The processor 51 may be a central processing unit (CPU). The processor 51 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0101] Memory 52, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs, and modules, such as the corresponding program instructions / modules in the embodiments of the present invention. Processor 51 executes the non-transitory software programs, instructions, and modules stored in memory 52 to perform various processor functions and data processing, thereby implementing the power terminal device fingerprint generation method in the above-mentioned method embodiment.

[0102] The memory 52 may include a program storage area and a data storage area, wherein the program storage area may store applications required for operating the device and at least one function; the data storage area may store data created by the processor 51, etc. In addition, the memory 52 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 52 may optionally include a memory remotely located relative to the processor 51, and these remote memories may be connected to the processor 51 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0103] The one or more modules are stored in the memory 52 and when executed by the processor 51, perform the following steps: Figure 1 The power terminal device fingerprint generation method in the illustrated embodiment.

[0104] For details of the above electronic equipment, please refer to Figure 1 The corresponding descriptions and effects in the embodiments shown can be understood and will not be repeated here.

[0105] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for generating fingerprints of power terminal equipment, characterized in that: include: Obtain network data traffic when power terminal equipment communicates with the server; Performing data preprocessing on the network data traffic based on the IP addresses of the data packets in the network data traffic to obtain a preprocessing result; Constructing a Huffman tree based on the preprocessing result; Generating a fingerprint of the power terminal device based on a pruning result of the Huffman tree; The network data traffic is preprocessed based on the IP address of the data packet in the network data traffic to obtain a preprocessing result, including: Dividing the network data traffic based on IP addresses of data packets of the network data traffic to obtain a plurality of network traffic segments; forming a representation sequence of the network traffic segments according to labels corresponding to message types of data packets in each network traffic segment; calculating an average utility of each network traffic segment based on the representation sequence to obtain a preprocessing result; Before forming a representation sequence of the network traffic segments according to the labels corresponding to the message types of the data packets in each network traffic segment, the method includes: Get the message type during historical communication between the server and the power terminal equipment; Generate labels corresponding to each message type; Calculating an average utility of each network traffic segment based on the representation sequence, including: Based on the representation sequence, the utility of each tag in each network traffic segment is calculated using the TF-IDF algorithm; The utility average of all labels in each network traffic segment is calculated to obtain the average utility of each network traffic segment.

2. The power terminal device fingerprint generation method according to claim 1, characterized in that: The network data traffic is divided based on the IP addresses of the data packets of the network data traffic to obtain a plurality of network traffic segments, including: Obtaining the source IP address and destination IP address of each data packet in the network data flow; Determine whether the source IP address and destination IP address of any two adjacent data packets are the same; When they are not the same, the network data traffic is divided, and a plurality of traffic segments are obtained according to the division result.

3. The method for generating fingerprint of power terminal equipment according to claim 1, characterized in that: Constructing a Huffman tree based on the preprocessing result, including: Comparing the average utility of each network traffic segment with a first preset threshold, and determining a network traffic segment that is greater than the first preset threshold; A Huffman tree is constructed according to network traffic segments that are greater than the first preset threshold.

4. The power terminal device fingerprint generation method according to claim 3, characterized in that: Constructing a Huffman tree according to the network traffic segments greater than the preset threshold includes: Forming a path of a Huffman tree based on the network traffic segments that are larger than the preset threshold, wherein the label in each network traffic segment is a tree node in the path; Determine whether there are duplicate nodes between different paths of the Huffman tree; If there are duplicate nodes, merge them.

5. The method for generating fingerprint of power terminal equipment according to claim 4, characterized in that: Generating a fingerprint of the power terminal device based on a pruning result of the Huffman tree includes: Calculate the average utility of each message type; Determining whether the average utility of the message type corresponding to the root node of each path in the Huffman tree is less than a second preset threshold; Delete the root node whose average utility of the corresponding message type is less than the second preset threshold, and use the next node of the root node as the new root node, where the average utility of the message type corresponding to the next node is greater than the second preset threshold; The remaining paths in the Huffman tree are merged to generate the fingerprint of the power terminal device.

6. A fingerprint generation device for power terminal equipment, characterized in that: include: Traffic acquisition module, used to obtain network data traffic when power terminal equipment communicates with the server; A preprocessing module, configured to perform data preprocessing on the network data traffic based on the IP addresses of the data packets in the network data traffic to obtain a preprocessing result; A tree construction module, configured to construct a Huffman tree based on the preprocessing result; A fingerprint generating module, configured to generate a fingerprint of the power terminal device based on a pruning result of the Huffman tree; The network data traffic is preprocessed based on the IP address of the data packet in the network data traffic to obtain a preprocessing result, including: Dividing the network data traffic based on IP addresses of data packets of the network data traffic to obtain a plurality of network traffic segments; forming a representation sequence of the network traffic segments according to labels corresponding to message types of data packets in each network traffic segment; calculating an average utility of each network traffic segment based on the representation sequence to obtain a preprocessing result; Before forming a representation sequence of the network traffic segments according to the labels corresponding to the message types of the data packets in each network traffic segment, the method includes: Get the message type during historical communication between the server and the power terminal equipment; Generate labels corresponding to each message type; Calculating an average utility of each network traffic segment based on the representation sequence, including: Based on the representation sequence, the utility of each tag in each network traffic segment is calculated using the TF-IDF algorithm; The utility average of all labels in each network traffic segment is calculated to obtain the average utility of each network traffic segment.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the power terminal device fingerprint generation method according to any one of claims 1 to 5.

8. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the power terminal device fingerprint generation method according to any one of claims 1 to 5 by executing the computer instructions.

Images