IoT device behavior signature construction method

Abstract

The invention discloses an IoT (Internet of Things) equipment behavior signature construction method, which comprises the following steps of: firstly, processing mixed traffic captured by a gateway, extracting traffic data packet information, segmenting traffic of various behaviors from session levels, then extracting data packet level information such as length, time interval and protocol type of traffic data packets, and calculating occurrence frequency; the method comprises the following steps: constructing feature vectors of behaviors, adopting DBSCAN clustering to obtain respective clusters of different behaviors, and automatically constructing a signature of the behavior from each behavior cluster, and the signature is composed of ordered data packet header information and statistical features and comprises key information for distinguishing similar device behaviors. According to the method, the mixed traffic can be automatically processed, signatures of different behaviors can be constructed, and the method has extremely high unique identification.

Images