A terminal device real-time identification verification method, device, equipment and medium

Abstract

This invention relates to the field of terminal verification technology, and discloses a method, apparatus, device, and medium for real-time identification and verification of terminal devices. The method includes: acquiring several data packets sent by the terminal device during a network session; extracting feature information from the data packets; generating a real-time terminal device fingerprint based on the feature information; comparing the real-time terminal device fingerprint with a preset terminal device fingerprint; and verifying the security of the terminal device based on the comparison result. This invention enables real-time extraction of fingerprint features from the terminal device while it is running, thereby verifying the security of the terminal device's identity and further improving the security and reliability of the terminal device.

Description

Technical Field

[0001] This invention relates to the field of terminal verification technology, and specifically to a method, apparatus, device, and medium for real-time identification and verification of terminal devices. Background Technology

[0002] With the development of the times and the progress of technology, the Internet has become a necessity in people's daily lives. At the same time, with the continuous development of network technology, the field of network security has attracted widespread attention and become a new research hotspot. Its research has strong practical significance. Once illegal devices access the network or devices are intruded, it will bring unpredictable adverse effects.

[0003] However, with the rapid development of network communication technology, simply authenticating terminal devices when they access wireless networks is no longer sufficient to meet current security requirements. Authentication of terminal devices only upon network access is highly incomplete; our focus is on how to authenticate the identity of terminal devices in real time while they are running.

[0004] Currently, there is no method to authenticate the identity of a terminal device in real time while the device is running. Instead, there is a method that only authenticates the terminal device when it accesses the network. This method cannot guarantee the security of the device during real-time operation, resulting in insufficient device security. Summary of the Invention

[0005] In view of this, the present invention provides a method, apparatus, device and medium for real-time identification and verification of terminal devices, in order to solve the technical problem that the prior art cannot identify in real time during the operation of terminal devices, resulting in insufficient security.

[0006] In a first aspect, the present invention provides a real-time identification and verification method for a terminal device, comprising: acquiring a plurality of data packets sent by the terminal device during a network session; extracting feature information of the data packets; generating a real-time terminal device fingerprint based on the feature information; comparing the real-time terminal device fingerprint with a preset terminal device fingerprint, and verifying the security of the terminal device based on the comparison result.

[0007] The real-time identification and verification method for terminal devices in this invention acquires several data packets sent by the terminal device during a network session, extracts the feature information of the data packets, and generates a real-time terminal device fingerprint based on the feature information. This enables the real-time extraction of fingerprint features of the terminal device while it is in operation, thereby verifying the security of the terminal device's identity and further improving the security and reliability of the terminal device.

[0008] In one optional implementation, extracting the feature information of the data packet includes: obtaining the packet header data and information content data of the data packet; extracting first sub-feature information based on the packet header data; extracting second sub-feature information based on the information content data; and combining the first sub-feature information and the second sub-feature information to generate the feature information of the data packet.

[0009] By dividing data packets into header data and content data and obtaining corresponding feature information for each, the feature information of the data packets can be generated. This allows for the corresponding processing of different types of data, making the extracted feature information more accurate.

[0010] In one optional implementation, the step of extracting the first sub-feature information based on the header data includes: extracting the attributes of the header data; performing a hash calculation on the attributes and converting the calculation result into a first binary string; and generating the first sub-feature information based on the first binary string.

[0011] By generating first sub-feature information based on the attributes of packet header data, features can be extracted based on the characteristic that packet header data is structured data, thereby enhancing the accuracy of the first sub-feature information.

[0012] In one optional implementation, generating the first sub-feature information based on the first binary string includes: sequentially performing weighted processing, merging processing, and normalization processing on the first binary string to generate the first sub-feature information.

[0013] Weighted processing, merging processing, and normalization processing based on the first binary string can further refine the first sub-feature information, making it more accurately describe the characteristics of the packet header data.

[0014] In one optional implementation, the step of extracting the second sub-feature information based on the information content data includes: calculating the entropy of the payload based on the information content data; determining the type of the information content data based on the entropy of the payload; extracting the processing unit of the information content data based on the type of the information content data; performing a hash calculation on the processing unit and converting the calculation result into a second binary string; and generating the second sub-feature information based on the second binary string.

[0015] The type of information content data is obtained by the entropy of the payload, thereby enabling processing units to extract the information content data using different processing methods, resulting in better expression of the second sub-feature information generated by the processing unit.

[0016] In one optional implementation, the processing unit for extracting information content data according to the type of information content data includes: if the type of information content data is text data, then based on information extraction technology in natural language processing, key information in the information content data is obtained, and the key information is used as a processing unit; if the type of information content data is non-text data, then the information content data is split into several groups of data according to a preset size, and the grouped data is used as a processing unit.

[0017] When the information content of the data packet is text data, natural language processing information extraction technology is used to extract key information, so that the expression effect of the generated second sub-feature information is better, thereby making the recognition capability of the extracted real-time terminal device fingerprint stronger.

[0018] In one optional implementation, generating the second sub-feature information based on the second binary string includes: performing weighted processing, merging processing, and normalization processing on the second binary string in sequence to generate the second sub-feature information.

[0019] Weighted processing, merging processing, and normalization processing based on the second binary string can further refine the second sub-feature information, making it more accurately describe the characteristics of the data packet's information content.

[0020] Secondly, the present invention provides a real-time identification and verification device for a terminal device, comprising: a data packet acquisition module for acquiring a plurality of data packets sent by the terminal device during a network session; a feature extraction module for extracting feature information of the data packets; a fingerprint generation module for generating a real-time terminal device fingerprint based on the feature information; and a fingerprint verification module for comparing the real-time terminal device fingerprint with a preset terminal device fingerprint and verifying the security of the terminal device based on the comparison result.

[0021] Thirdly, the present invention provides a computer device, including: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the real-time identification and verification method for terminal devices according to any embodiment of the first aspect above.

[0022] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions, the computer instructions being used to cause a computer to execute the real-time identification and verification method for terminal devices according to any embodiment of the first aspect above. Attached Figure Description

[0023] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating the real-time identification and verification method for terminal devices according to an embodiment of the present invention;

[0025] Figure 2 This is a flowchart illustrating another terminal device real-time identification and verification method according to an embodiment of the present invention;

[0026] Figure 3 This is a structural block diagram of the real-time identification and verification device for terminal devices according to an embodiment of the present invention;

[0027] Figure 4 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] The real-time identification and verification method for terminal devices according to the present invention is applicable to single-function terminal devices, especially the security verification of power terminal devices after they have entered a stable operating state.

[0030] According to an embodiment of the present invention, a real-time identification and verification method for a terminal device is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] Figure 1 This is a flowchart of the real-time identification and verification method for terminal devices according to an embodiment of the present invention, such as... Figure 1 As shown, the real-time identification and verification method for terminal devices according to an embodiment of the present invention includes the following steps:

[0032] Step S101: Obtain several data packets sent by the terminal device during the network session period.

[0033] Specifically, during a network session, the terminal device sends multiple data packets for communication. The network session period is defined based on the single-function characteristic of the power terminal device. Due to the single function of the power terminal device, its network sessions have a certain degree of repetition, i.e., periodicity. A session can be viewed as a sequence of data packets with the same source / destination IP address and source / destination port number in both directions of the communication flow. Since there are too many cases where the session lengths of different functions and types of power terminal devices vary, storing them all is impractical. Therefore, in this step, only a specific number of data packets within a period are retrieved. The number of data packets retrieved can be set according to the actual situation of the terminal device. For example, the size of the data packet sequence, i.e., the number of data packets, is determined by analyzing the number of data packets in each session of some sample terminal devices in advance, and weighing the factors to determine the number of data packets included in each network session period, i.e., determining the number of data packets within the network session period to be extracted for the terminal device to be identified.

[0034] Step S102: Extract the feature information of the data packet.

[0035] For each data packet, its feature information needs to be extracted to construct a terminal device fingerprint. The data content of each data packet includes information about the packet source and destination, protocol type, packet format, and specific data transmission content. By performing feature processing on each data packet, corresponding feature information is obtained. This feature information is unique, meaning that different data packets correspond to their own unique feature information.

[0036] Step S103: Generate a real-time terminal device fingerprint based on the feature information.

[0037] Specifically, after obtaining the feature information of each data packet, the feature information of all data packets is merged to obtain the final real-time terminal device fingerprint.

[0038] Step S104: Compare the real-time terminal device fingerprint with the preset terminal device fingerprint, and verify the security of the terminal device based on the comparison result.

[0039] Specifically, the preset terminal device fingerprint is a pre-extracted terminal device fingerprint stored in the identification device fingerprint database. For example, each type of terminal device extracts its fingerprint before operation and then stores it in the device fingerprint database.

[0040] After the terminal device enters a stable operating state, it periodically acquires several data packets sent by the terminal device during the network session cycle, or acquires several data packets according to a set period, and performs the above steps to obtain a real-time terminal device fingerprint, which is then compared with a preset terminal device fingerprint. When the comparison result is the same, it indicates that the terminal device has been correctly identified and is currently secure. If the comparison result is different, it indicates that the current terminal device poses a risk, and relevant personnel need to be alerted or warned.

[0041] The real-time identification and verification method for terminal devices in this invention obtains several data packets sent by the terminal device during a network session, extracts the feature information of the data packets, and generates a real-time terminal device fingerprint based on the feature information. This enables the real-time extraction of fingerprint features of the terminal device while it is in operation, thereby verifying the security of the terminal device's identity and further improving the security and reliability of the terminal device.

[0042] This invention provides a method for real-time identification and verification of terminal devices. Figure 2 This is a flowchart of the real-time identification and verification method for terminal devices according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0043] Step S201: Obtain several data packets sent by the terminal device during the network session period. For details, please refer to [link to relevant documentation]. Figure 1 Step S102 of the illustrated embodiment will not be described again here.

[0044] Step S202: Extract the feature information of the data packet.

[0045] Specifically, step S202 includes:

[0046] Step S2021: Obtain the packet header data and information content data of the data packet.

[0047] Specifically, each data packet includes header data and message content data. The header data includes information about the data packet source and destination, protocol type, data packet format, etc. The message content data contains the actual data transmission content. Data packets are then split to obtain the header data and message content data.

[0048] Baotou data is structured data. Structured data refers to highly organized and neatly formatted data. Before receiving the data, the system already understands its internal structure, meaning it knows the meaning of a certain segment of the data, but not its specific content. Therefore, from the system's perspective, structured data is a large data unit composed of multiple small data units arranged in an orderly manner. These small data units can be called attributes, and the specific content of each small data unit is called the attribute value.

[0049] Information content data is unstructured data. Unstructured data has an internal structure, but it is not structured through a predefined data model or pattern. That is, the system does not know the specific internal structure of unstructured data before receiving it. It may be text data (meaningful, logical data, such as text strings), or it may be non-text data (the logic of the data is difficult to perceive with the naked eye, such as binary files); it may be human-generated or machine-generated.

[0050] Step S2022: Extract the first sub-feature information based on the header data.

[0051] Step S2023: Extract the second sub-feature information based on the information content data.

[0052] Specifically, the first sub-feature information and the second sub-feature information are extracted from the header data and the information content data, respectively. Different methods can be used to extract the first sub-feature information and the second sub-feature information according to the characteristics of structured data and unstructured data, so that the first sub-feature information and the second sub-feature information have stronger representation capabilities.

[0053] Step S2024: Combine the first sub-feature information and the second sub-feature information to generate the feature information of the data packet.

[0054] Specifically, the first sub-feature information and the second sub-feature information are concatenated to obtain the feature information of the data packet.

[0055] By dividing data packets into header data and content data and obtaining corresponding feature information for each, the feature information of the data packets can be generated. This allows for the corresponding processing of different types of data, making the extracted feature information more accurate.

[0056] In some alternative implementations, step S2022 includes:

[0057] Step a1: Extract the attributes of the packet header data.

[0058] Specifically, the packet header is divided according to its attribute format. Since the packet header data is structured data, and the internal structure of structured data is well-defined, the packet header is directly divided into multiple small attribute units according to its attribute format.

[0059] PH = {h1,h2,h3,…,h} n}

[0060] Where PH represents the header data of the data packet, h n This represents the nth attribute in the header data.

[0061] Step a2: Hash the attributes and convert the result into a first binary string.

[0062] Specifically, after extracting each attribute from the packet header data, a hash calculation is performed on the value of each attribute, and the result is converted into a binary string. Thus, for each attribute in the packet header data, a fixed-length binary string can be obtained. The calculation process can be described by the following formula:

[0063] str(hash(h n ))=shn1

[0064] Here, shn1 represents the first binary string obtained.

[0065] Step a3: Generate the first sub-feature information based on the first binary string.

[0066] The first binary string obtained is an abstract representation of the header data. The first sub-feature information is obtained by processing the data.

[0067] By generating first sub-feature information based on the attributes of packet header data, features can be extracted based on the characteristic that packet header data is structured data, thereby enhancing the accuracy of the first sub-feature information.

[0068] In some alternative implementations, step a3 includes:

[0069] The first binary string is then subjected to weighted processing, merging processing, and normalization processing in sequence to generate the first sub-feature information.

[0070] Specifically, the weighted processing procedure is as follows:

[0071] The calculated binary string is weighted using the TF-IDF method. After weighting, the result is correlated with the importance of each attribute in the packet header data.

[0072] TF-IDF (term frequency-inverse document frequency) is a commonly used weighting technique in information retrieval and text mining. TF-IDF is a statistical method used to evaluate the importance of a term to a document within a document set or corpus. A term's importance increases proportionally to its frequency of occurrence in the document, but decreases inversely proportionally to its frequency of occurrence in the corpus. Various forms of TF-IDF weighting are frequently used by search engines as a measure or ranking of the relevance between documents and user queries. In addition to TF-IDF, internet search engines also use link analysis-based ranking methods to determine the order in which documents appear in search results.

[0073] The principle of TF-IDF is that in a given document, term frequency refers to the frequency with which a given word appears in that document. This number is a normalized word count to prevent it from being biased towards longer documents. (The same word may have a higher word count in a longer document than in a shorter document, regardless of the word's importance.) For a word in a specific document, its importance can be expressed as:

[0074]

[0075] Where n i，j Is this word in file d? j The number of occurrences in the denominator is the number of occurrences in the file d. j The sum of the number of occurrences of all words in the text.

[0076] Reverse document frequency (IDF) is a measure of the general importance of a word. The IDF of a specific word can be obtained by dividing the total number of documents by the number of documents containing that word, and then taking the logarithm to base 10 of the quotient.

[0077]

[0078] Where |D| is the total number of files in the corpus, and |{j:t1∈d} j}| indicates that the word t is included. i The number of files (i.e., the number of files ≠ 0) is calculated by multiplying the denominator by the number of files if the words are not in the data. Therefore, 1+|{j:t is generally used. i ∈d j Then calculate the weighting factor tfidf. i,j :

[0079] tfidf i,j =tf i,j ×idf i

[0080] Weighting factor tfidf i,j This indicates the weight of the word ti. In this embodiment of the invention, each attribute is equivalent to a word, the data packet is equivalent to a file, and attributes are pre-collected to form an attribute library, which is equivalent to a file set or corpus.

[0081] The merging process is as follows:

[0082] The individual number strings are added using vector addition, meaning each digit is added independently without carrying over. The purpose of this step is to combine the results so that the result is relevant to the header data of the entire data packet.

[0083] The normalization process is as follows:

[0084] The vector obtained after merging is normalized, that is, if the current bit is greater than 0, it is set to 1, otherwise it is set to 0, thereby generating the feature information of the data packet header.

[0085] Weighted processing, merging processing, and normalization processing based on the first binary string can further refine the first sub-feature information, making it more accurately describe the characteristics of the packet header data.

[0086] In some alternative implementations, step S2023 includes:

[0087] Step b1: Calculate the entropy of the payload based on the information content data.

[0088] Data packets transmit various types of information. Different types of data packets, i.e., whether the information content they carry is text data or non-text data, require different feature extraction methods to obtain the second sub-feature information of the information content in the data packet. Therefore, it is first necessary to determine the type of information transmitted by the data packet, i.e., the type of information content data. In this embodiment of the invention, the entropy of the payload is used to determine the type of information content data.

[0089] The entropy of the payload can be used to distinguish different types of information content data. If the data packet carries plain text stream data, that is, the information content data is text data, the payload entropy is the lowest; if the data packet carries non-text data such as audio, images, and video, the entropy will increase proportionally in that order. Specifically, the payload entropy is represented by the Shannon entropy of an m-byte sequence. The formula for calculating the Shannon entropy of an m-byte sequence with a symbol length of 8 bits or 1 byte is as follows:

[0090]

[0091] In the formula, p i It represents the probability of byte value i appearing in m bytes.

[0092] Step b2: Determine the type of information content data based on the entropy of the payload.

[0093] Specifically, the type of information content data is determined based on the entropy value of the payload, identifying whether the information content it carries is plain text data or non-text data. Different thresholds can be set based on the entropy of the payload corresponding to different types of information content data. For example, when the entropy of the payload is less than a certain threshold, the information content data is text data; otherwise, the information content data is non-text data. Other thresholds can also be set to further determine whether it belongs to audio, image, or video.

[0094] Step b3: Extract the information content data processing unit according to the type of information content data.

[0095] Different types of information content data have different data structures, therefore, it is necessary to extract processing units according to their types. The methods for extracting processing units and the size of the selected processing units differ for different types of information content data.

[0096] Step b4: Perform hash calculation on the processing unit and convert the calculation result into a second binary string.

[0097] Specifically, after extracting all processing units from the information content data, the value h of each processing unit is... n2 A hash calculation is performed, and the result is converted into a binary string. Thus, for each processing unit, a fixed-length binary string is obtained. The calculation process can be described by the following formula:

[0098] str(hash(h n2 ))=shn2

[0099] Here, shn2 represents the obtained second binary string.

[0100] Step b5: Generate second sub-feature information based on the second binary string.

[0101] The obtained second binary string is an abstract representation of the information content data. The second sub-feature information is obtained by processing the data.

[0102] By obtaining the type of information content data through the entropy of the payload, processing units that extract information content data using different processing methods are selected, resulting in better expression of the second sub-feature information generated by the processing units.

[0103] In some alternative implementations, step b3 above includes:

[0104] Step b31: If the information content data is text data, then based on the information extraction technology in natural language processing, the key information in the information content data is obtained and the key information is used as a processing unit.

[0105] Specifically, Information Extraction (IE) technology extracts specific information needed for a task from natural language text, facilitating the automatic classification, extraction, and reconstruction of massive amounts of content. For information extraction from unstructured, massive text data, its main task is to automatically extract factual information such as entities, relationships, and events of specified types. Information extraction can be divided into three sub-tasks:

[0106] 1) Entity extraction

[0107] Entity extraction is generally considered to be the process of identifying meaningful entities or entity references from raw text, that is, identifying named entities from unstructured text and classifying them into corresponding entity types. Common entity types for this task include person names, place names, organization names, dates, etc.

[0108] There are two criteria for evaluating whether a named entity has been correctly identified: first, whether the entity's boundaries are correct; and second, whether the entity's type is correctly labeled. Research methods for named entity recognition have evolved from early dictionary- and rule-based approaches to traditional machine learning methods, then to deep learning-based methods, and finally to current popular approaches such as attention mechanisms and graph neural networks.

[0109] 2) Relation Extraction

[0110] Relation extraction, or relation extraction, is the process of extracting containment relationships from text and is a crucial component of Internet Explorer. It primarily handles the extraction of semantic relationships between entities from massive amounts of unstructured text and is frequently used in information retrieval and question-answering systems. Its main task is to determine the semantic relationship between two entities in a given sentence, essentially a multi-classification problem. Currently, commonly used relation extraction methods are mainly divided into five categories: dictionary-based, pattern matching-based, machine learning algorithm-based, ontology-based, and hybrid methods.

[0111] 3) Event Extraction

[0112] Event extraction is a classic task in the field of information extraction. An event is a concept that refers to the movement of several things related to a specific contradiction within a certain time and space. "Things" refer to people, organizations, ideas, materials, etc., that are directly or indirectly related to the "problem," "business," or "goal." For example, the sentence "Xiaoming goes to school tomorrow" describes an event.

[0113] Event extraction primarily involves identifying key elements, or schemas, of an event relevant to a target from massive amounts of unstructured text data. Currently, event extraction generally consists of two subtasks: first, identifying the event and determining its type; second, identifying the event's stakeholders. Event extraction parsing methods are categorized into two types: pipelined models and joint models.

[0114] The proposed Universal Information Extraction (UIE) framework has achieved unified modeling for tasks such as entity extraction, relation extraction, event extraction, and sentiment analysis, enabling good transfer and generalization capabilities across different tasks.

[0115] When the information content data is text data, key information in the information content data is obtained based on information extraction technology in natural language processing. This key information includes entities, relationships and events. In this embodiment of the invention, entities, relationships and events in the text are extracted based on information extraction technology, and the extracted entities, relationships and events are used as processing units.

[0116] Step b32: If the information content data is non-text data, then the information content data is split into several groups of data according to a preset size, and the grouped data is used as a processing unit.

[0117] Specifically, if the information content data is non-text data, it is grouped according to a preset size. The preset size can be set according to the actual situation. Different non-text data, such as audio, images and videos, have different preset sizes.

[0118] When the information content of the data packet is text data, natural language processing information extraction technology is used to extract key information, so that the expression effect of the generated second sub-feature information is better, thereby making the recognition capability of the extracted real-time terminal device fingerprint stronger.

[0119] In some optional implementations, step b5, generating second sub-feature information based on the second binary string, includes:

[0120] The second binary string is then subjected to weighting, merging, and normalization processes sequentially to generate the second sub-feature information. The weighting, merging, and normalization processes are the same as those in step a3, and will not be repeated here.

[0121] Weighted processing, merging processing, and normalization processing based on the second binary string can further refine the second sub-feature information, making it more accurately describe the characteristics of the data packet's information content.

[0122] Step S203: Generate a real-time terminal device fingerprint based on the feature information. For details, please refer to [link to relevant documentation]. Figure 1 Step S102 of the illustrated embodiment will not be described again here.

[0123] Step S204: Compare the real-time terminal device fingerprint with the preset terminal device fingerprint, and verify the security of the terminal device based on the comparison result. For details, please refer to [link to relevant documentation]. Figure 1 Step S102 of the illustrated embodiment will not be described again here.

[0124] The real-time identification and verification method for terminal devices in this invention, based on the fact that power terminal devices have a single function and therefore network sessions are periodic, enables the real-time extraction of the terminal device's fingerprint while the terminal device is in operation, thereby verifying the security of the terminal device's identity and further improving the reliability of accessing the terminal device. Simultaneously, this invention can perform feature extraction based on real-time network traffic data packets, eliminating the need for extensive pre-collection of data, making it more convenient and efficient. When extracting features from data packets, different feature extraction methods are used for header data (structured data) and information content data (unstructured data). In particular, when the data packet information content is text data, natural language processing information extraction technology is used to extract key information, making the extracted real-time terminal device fingerprint recognition capability stronger.

[0125] This invention also proposes a real-time identification and verification device for terminal devices, such as... Figure 3 As shown, the device includes:

[0126] The data packet acquisition module 301 is used to acquire several data packets sent by the terminal device during the network session. The specific details are the same as in the above method embodiment and will not be repeated here.

[0127] The feature extraction module 302 is used to extract feature information from the data packet. The specific details are the same as in the above method embodiment and will not be repeated here.

[0128] The fingerprint generation module 303 is used to generate a real-time terminal device fingerprint based on feature information. The specific details are the same as in the above-described method embodiment and will not be repeated here.

[0129] The fingerprint verification module 304 is used to compare the real-time terminal device fingerprint with a preset terminal device fingerprint, and verify the security of the terminal device based on the comparison result. The specific details are the same as in the above-described method embodiment, and will not be repeated here.

[0130] The terminal device real-time identification and verification device of this invention acquires several data packets sent by the terminal device during a network session, extracts the feature information of the data packets, and generates a real-time terminal device fingerprint based on the feature information. This enables the real-time extraction of the fingerprint features of the terminal device while it is in operation, thereby verifying the security of the terminal device's identity and further improving the security and reliability of the terminal device.

[0131] In some alternative implementations, the feature extraction module 302 includes:

[0132] The data acquisition module is used to acquire the header data and information content data of data packets;

[0133] The first sub-feature extraction module is used to extract the first sub-feature information based on the packet header data;

[0134] The second sub-feature extraction module extracts second sub-feature information based on the information content data;

[0135] The feature generation module is used to combine the first sub-feature information and the second sub-feature information to generate the feature information of the data packet.

[0136] In some optional implementations, the first sub-feature extraction module includes:

[0137] The attribute extraction module is used to extract attributes from the packet header data;

[0138] The first hash module is used to perform hash calculations on the attributes and convert the calculation results into a first binary string;

[0139] The first sub-feature generation module is used to generate first sub-feature information based on the first binary string.

[0140] In some optional implementations, the first sub-feature generation module is used to generate first sub-feature information by sequentially performing weighted processing, merging processing and normalization processing on the first binary string.

[0141] In some optional implementations, the second sub-feature extraction module includes:

[0142] The entropy calculation module is used to calculate the entropy of the payload based on the information content data.

[0143] The type determination module is used to determine the type of information content data based on the entropy of the payload;

[0144] The processing unit extraction module is a processing unit used to extract information content data according to the type of information content data.

[0145] The second hash module is used to perform hash calculations on the processing unit and convert the calculation results into a second binary string;

[0146] The second sub-feature generation module generates second sub-feature information based on the second binary string.

[0147] In some optional implementations, the processing unit extraction module includes:

[0148] The first extraction unit is used to extract key information from the information content data based on information extraction technology in natural language processing if the type of information content data is text data, and to use the key information as a processing unit.

[0149] The second extraction unit is used to split the information content data into several groups of data according to a preset size if the type of information content data is non-text data, and to use the grouped data as processing units.

[0150] In some optional implementations, the second sub-feature generation module is used to generate second sub-feature information by sequentially performing weighted processing, merging processing and normalization processing on the second binary string.

[0151] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0152] In this embodiment, the terminal device real-time identification and verification device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0153] Please see Figure 4 , Figure 4 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 4 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 4 Take a processor 10 as an example.

[0154] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0155] The memory 20 stores instructions executable by at least one processor 10 to cause at least one processor 10 to perform the method shown in the above embodiments.

[0156] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0157] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0158] The computer device also includes a communication interface 30 for communicating with other devices or communication networks.

[0159] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0160] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A real-time identification and verification method for terminal devices, characterized in that, include: To acquire several data packets sent by the terminal device during a network session; Extract the feature information of the data packet; A real-time terminal device fingerprint is generated based on the aforementioned feature information; The real-time terminal device fingerprint is compared with the preset terminal device fingerprint. The security of the terminal device is verified based on the comparison result. When the comparison result is the same, it means that the terminal device is correctly identified and the current terminal device is secure. If the comparison result is different, it means that the current terminal device is at risk and relevant personnel need to be reminded or warned. The extraction of feature information from the data packet includes: Obtain the header data and information content data of the data packet; Extract the first sub-feature information based on the header data; Extract the second sub-feature information based on the information content data; The first sub-feature information and the second sub-feature information are combined to generate the feature information of the data packet; The step of extracting the second sub-feature information based on the information content data includes: Calculate the entropy of the payload based on the information content data; The type of the information content data is determined based on the entropy of the payload; A processing unit that extracts the information content data according to the type of the information content data; The processing unit performs a hash calculation and converts the calculation result into a second binary string; The second sub-feature information is generated based on the second binary string; The processing unit for extracting the information content data according to the type of the information content data includes: If the type of the information content data is text data, then based on the information extraction technology in natural language processing, the key information in the information content data is obtained, and the key information is used as a processing unit. If the information content data is of a non-text type, the information content data is split into several groups of data according to a preset size, and the grouped data is used as a processing unit.

2. The method according to claim 1, characterized in that, The step of extracting the first sub-feature information based on the header data includes: Extract the attributes of the packet header data; The attribute is hashed and the result is converted into a first binary string. The first sub-feature information is generated based on the first binary string.

3. The method according to claim 2, characterized in that, The step of generating the first sub-feature information based on the first binary string includes: The first binary string is then subjected to weighted processing, merging processing, and normalization processing in sequence to generate the first sub-feature information.

4. The method according to claim 1, characterized in that, The generation of the second sub-feature information based on the second binary string includes: The second binary string is then subjected to weighting, merging, and normalization processes in sequence to generate the second sub-feature information.

5. A real-time identification and verification device for terminal equipment, characterized in that, include: The data packet acquisition module is used to acquire several data packets sent by the terminal device during the network session period; The feature extraction module is used to extract feature information from the data packet; The fingerprint generation module is used to generate a real-time terminal device fingerprint based on the feature information; The fingerprint verification module is used to compare the real-time terminal device fingerprint with the preset terminal device fingerprint, and verify the security of the terminal device based on the comparison result. When the comparison result is the same, it means that the terminal device is correctly identified and the current terminal device is secure. If the comparison result is different, it means that the current terminal device has a risk and relevant personnel need to be reminded or warned. The feature extraction module includes: The data acquisition module is used to acquire the header data and information content data of data packets; The first sub-feature extraction module is used to extract the first sub-feature information based on the packet header data; The second sub-feature extraction module extracts second sub-feature information based on the information content data; The feature generation module is used to combine the first sub-feature information and the second sub-feature information to generate the feature information of the data packet. The second sub-feature extraction module includes: The entropy calculation module is used to calculate the entropy of the payload based on the information content data. The type determination module is used to determine the type of information content data based on the entropy of the payload; The processing unit extraction module is a processing unit used to extract information content data according to the type of information content data. The second hash module is used to perform hash calculations on the processing unit and convert the calculation results into a second binary string; The second sub-feature generation module generates second sub-feature information based on the second binary string; The processing unit extraction module includes: The first extraction unit is used to extract key information from the information content data based on information extraction technology in natural language processing if the type of information content data is text data, and to use the key information as a processing unit. The second extraction unit is used to split the information content data into several groups of data according to a preset size if the type of information content data is non-text data, and to use the grouped data as processing units.

6. A computer device, characterized in that, include: The device includes a memory and a processor, which are interconnected. The memory stores computer instructions, and the processor executes the computer instructions to perform the real-time identification and verification method for the terminal device according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the real-time identification and verification method for the terminal device as described in any one of claims 1 to 4.

Images