Network device user identification method and system based on network protocol analysis

Abstract

The invention provides a network equipment user identification method and system based on network protocol analysis, and relates to the technical field of network equipment user identification, and the method comprises the steps: collecting network protocol data generated when a user interacts with network equipment; performing protocol analysis on the network protocol data to obtain protocol features; according to the protocol characteristics, user category labeling is carried out on the network protocol data; performing differential coding and splicing on the protocol features to form a network protocol feature vector; constructing a network equipment user identification model based on a deep neural network, and predicting a user category according to the network protocol feature vector; comparing the user category prediction result with the user category labeling result, and performing iterative training on the network equipment user identification model; collecting real-time network protocol data generated when a user interacts with network equipment, and converting the real-time network protocol data into a real-time network protocol feature vector; and identifying unknown user categories through the trained network equipment user identification model.

Description

Technical Field

[0001] The present invention relates to the technical field of network device user identification, and in particular to a network device user identification method and system based on network protocol analysis. Background Art

[0002] With the progress of the times, computer and Internet technology have developed rapidly, and the number of devices and users in cyberspace has continued to increase and become increasingly diverse, such as smartphones, computers, smart home devices, etc. People interact extensively with a variety of networked devices through the Internet, and cyberspace has become an important part of people's lives and work. However, the hugeness and complexity of this network ecosystem also brings many security risks. Malicious behaviors such as hacker attacks, network fraud, and virus attacks in cyberspace frequently occur, resulting in user privacy leaks, malicious device manipulation, and even threats to national and social security. Therefore, exploring efficient and accurate cyberspace device user identification technology has become an important task in maintaining cyberspace security.

[0003] However, since traditional user identification methods are based on IP addresses, they are susceptible to IP address forgery and dynamic changes, and cannot ensure the accuracy and security of user identification. In addition, on the actual Internet, due to factors such as user privacy protection, the collected user data is incomplete and has data heterogeneity problems, which affects the integrity and consistency of device user information. Summary of the invention

[0004] In order to solve the problem that the traditional user identification method is based on IP address, which is susceptible to IP address forgery and dynamic changes, and cannot ensure the accuracy and security of user identification. In addition, on the actual Internet, due to factors such as user privacy protection, the collected user data is incomplete and data heterogeneity problems occur, thus affecting the integrity and consistency of device user information. The present invention provides a network device user identification method and system based on network protocol analysis.

[0005] The technical solution provided by the embodiment of the present invention is as follows:

[0006] First aspect:

[0007] An embodiment of the present invention provides a network device user identification method based on network protocol analysis, comprising:

[0008] S1: collects network protocol data generated when users interact with network devices;

[0009] S2: performing protocol parsing on the network protocol data to obtain various types of protocol features;

[0010] S3: marking the network protocol data with user categories according to the protocol characteristics;

[0011] S4: differentially encoding the multiple types of protocol features;

[0012] S5: splicing the multiple types of protocol features after differential encoding to form a network protocol feature vector of the network protocol data;

[0013] S6: Build a network device user identification model based on deep neural network;

[0014] S7: predicting the user category according to the network protocol feature vector and the network device user identification model;

[0015] S8: comparing the user category prediction result with the user category labeling result, and iteratively training the network device user recognition model;

[0016] S9: collecting real-time network protocol data generated when the user interacts with the network device, and converting the real-time network protocol data into a real-time network protocol feature vector;

[0017] S10: According to the real-time network protocol feature vector, the unknown user category is identified through the trained network device user identification model.

[0018] Second aspect:

[0019] An embodiment of the present invention provides a network device user identification system based on network protocol analysis, comprising: a memory and one or more processors;

[0020] One or more application programs are stored in the memory, and the one or more application programs are suitable for being executed by the one or more processors to implement the above-mentioned network device user identification method based on network protocol analysis.

[0021] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0022] In the present invention, by collecting network protocol data generated when users interact with network devices, the problem of IP addresses being susceptible to forgery and dynamic changes is overcome, and the accuracy and security of user identification can be ensured. By performing protocol parsing on the network protocol data, various types of protocol features are obtained, and user categories are labeled on the network protocol data based on the protocol features. The various types of protocol features are differentially encoded, thereby avoiding the problems of incomplete collected user data and data heterogeneity, and ensuring the integrity and consistency of device user information. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 A flowchart of a method for identifying a user of a network device based on network protocol analysis provided by an embodiment of the present invention;

[0025] Figure 2 A schematic diagram of the structure of a network device user identification system based on network protocol analysis provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0027] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0028] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0029] Reference Manual Attached Figure 1 , shows a flow chart of a network device user identification method based on network protocol analysis provided by an embodiment of the present invention.

[0030] The embodiment of the present invention provides a network device user identification method based on network protocol analysis, which can be implemented by a network device user identification device based on network protocol analysis, and the network device user identification device based on network protocol analysis can be a terminal or a server. The processing flow of the network device user identification method based on network protocol analysis can include the following steps:

[0031] S1: Collects network protocol data generated when users interact with network devices.

[0032] Specifically, multiple network protocol data generated when different users in a specific area of ​​the Internet interact with different network devices are detected and collected.

[0033] Optionally, each piece of network protocol data includes an IP address, port information, and device location.

[0034] It should be noted that different users interact with different network devices based on different types of network protocols, and different network protocols have different protocol structures.

[0035] Optionally, the network protocol includes HTTP, HTTPS, SSH and RTSP.

[0036] Among them, HTTP (Hypertext Transfer Protocol) is the Hypertext Transfer Protocol, which is a protocol used to transmit web page data on the Internet. It defines how to request and transmit web pages and related resources between clients (usually browsers) and servers. HTTP is a stateless protocol, which means that each request and response is independent and does not retain the context of any previous request.

[0037] HTTPS (Hypertext Transfer Protocol Secure) is a secure version of HTTP. It adds SSL / TLS protocol to HTTP to encrypt data transmission, ensuring that data will not be eavesdropped or tampered with during transmission between the client and the server. HTTPS provides data encryption, identity authentication and data integrity protection, and is a standard protocol for protecting Internet communication security.

[0038] Among them, SSH (Secure Shell) is a protocol for secure remote login and command execution. It provides a secure network communication channel through encryption technology, allowing users to securely connect to remote computers through an insecure network and execute commands, transfer files, etc. SSH is widely used in system management and network management, providing authentication, encryption and data integrity protection.

[0039] RTSP (Real-Time Streaming Protocol) is a protocol used to control streaming media servers. It is mainly used to establish, control and terminate streaming media sessions between clients and streaming media servers. RTSP allows clients to play, pause and fast-forward streaming media content, and is widely used in video surveillance and real-time streaming media playback systems.

[0040] In the present invention, by detecting and collecting network protocol data between users in a specific area and different network devices, a rich data sample can be obtained. This data covers the interaction between different users and devices, and can more comprehensively reflect the usage scenarios and characteristics of various network protocols. Collecting different types of network protocol data (such as HTTP, HTTPS, SSH, RTSP) can cover the characteristics and structures of various protocols. This ensures that the model has stronger adaptability when facing different protocol types, thereby improving the accuracy and robustness of user identification.

[0041] S2: Perform protocol analysis on network protocol data to obtain various types of protocol features.

[0042] Among them, protocol features include text features, numeric features, composite numeric features, and enumeration features.

[0043] In the present invention, each feature type has different expressions and information contents. For example, text features can reflect the command and request content in the protocol, numerical features can provide quantitative data such as network traffic size or timestamp, composite numerical features can combine the relationship of multiple numerical features, and enumeration features can identify the status or options in the protocol. This diversified feature expression can more accurately describe the complexity of the network protocol. Different feature types allow the use of different analysis and processing techniques. For example, text features can be processed using natural language processing technology, numerical features can be statistically analyzed, and enumeration features can be classified. By combining these different processing methods, network protocol data can be more deeply mined and analyzed.

[0044] S3: Label the network protocol data by user category based on protocol characteristics.

[0045] In a possible implementation, S3 specifically includes sub-steps S301 to S305:

[0046] S301: Screen and delete redundant protocol features in various types of network protocol data.

[0047] It should be noted that redundant protocol features are protocol features that are not helpful for user identification, including the network protocol data creation time "createDate" field and the operating system category "osCategory" field.

[0048] The network protocol data creation time "createDate" field (Creation Date): This field records the specific date and time when the network protocol data is generated or captured. It helps track the timeliness of the data, ensures the real-time and validity of the data, and is also used for time sorting and filtering during data management and analysis.

[0049] Among them, the operating system category "osCategory" field (Operating System Category): This field describes the type or category of the operating system running on the device that generates the network protocol data. It provides information about the device's operating environment, which helps with network security analysis and device management, and identifies the potential impact of different operating systems on network protocols.

[0050] Specifically, the protocol features that are not helpful for user identification in various types of network protocol data are manually screened and deleted.

[0051] In the present invention, by screening and deleting redundant protocol features (such as "createDate" and "osCategory") that are not helpful for user identification, the interference of irrelevant information on model training can be reduced, and the focus can be placed on features that are actually helpful for user identification, thereby improving data quality and analysis accuracy.

[0052] S302: Extracting common protocol features and unique protocol features from various types of network protocol data.

[0053] In the present invention, common protocol features and unique protocol features are extracted, which helps to understand the commonalities and uniqueness of all protocols in the data, ensure that the characteristics of each network protocol are fully considered, and enhance the model's adaptability to different protocols.

[0054] S303: For the unique protocol features in each type of network protocol data, the protocol features are supplemented in other types of network protocol data.

[0055] Specifically, for the unique protocol features in various types of network protocol data, the protocol features are completed in other types of network protocol data, thereby ensuring that all network protocol data follow the same data structure and retaining the key features of the network protocol data including IP address (IP Address), port information (Port Information), protocol type (protocol), transmission protocol (transProtocol), protocol flag (Banner) and device location (deviceLocation).

[0056] In the present invention, by completing the unique protocol features in other types of protocol data and unifying the data structure, all data follow the same format and structure, which helps the model process and analyze data from different sources and improves the consistency and accuracy of recognition.

[0057] S304: Cleaning the various types of network protocol data after protocol feature completion.

[0058] Optionally, data cleaning methods include missing value filling and data format specification to ensure the integrity and consistency of network protocol data.

[0059] In the present invention, missing value filling and data format standardization are used in the data cleaning process to ensure data consistency and integrity, further improve data quality, and lay a solid foundation for subsequent analysis and model training.

[0060] S305: Labeling the various types of network protocol data after data cleaning by user categories.

[0061] Specifically, based on the acquired expert knowledge, various types of network protocol data after data cleaning are manually labeled with user categories.

[0062] It should be noted that the acquired expert knowledge refers to the professional knowledge, experience and skills that can help experts make accurate judgments in the data labeling process.

[0063] In the present invention, the data is manually labeled using expert knowledge, which can fully utilize the experience and skills of domain experts to ensure the accuracy of the labeling. Expert knowledge can help identify complex patterns and subtle differences in data, thereby improving the accuracy of user category labeling.

[0064] S4: Differentiately encode multiple types of protocol features.

[0065] In a possible implementation, S4 specifically includes sub-steps S401 to S404:

[0066] S401: Encode text features through natural science language processing technology.

[0067] Optionally, the natural science language processing technology includes word segmentation technology, Word2Vec word embedding technology, bidirectional long short-term memory network and attention mechanism.

[0068] In a possible implementation, S401 specifically includes sub-steps S4011 to S4015:

[0069] S4011: Segment the text features through word segmentation technology to obtain an ordered vocabulary list corresponding to the text.

[0070] S4012: Convert the words in the ordered vocabulary list into word embedding vectors using Word2Vec word embedding technology.

[0071] Specifically, the Skip-gram model, a typical architecture of Word2Vec, is used to implement word embedding operations. In the Skip-gram model, each word is represented as a word embedding vector of fixed dimension. During the training process, the input of the Skip-gram model is a central word, and the goal is to predict the context words in the window around the word, and maximize the probability of the context words appearing given the central word. The Skip-gram model takes the one-hot encoding vector of the central word as input. The vector dimension is the number of words in the vocabulary. The number of neurons in the hidden layer is much smaller than the number of neurons in the input layer. The output layer represents the one-hot encoding vector of the context words around the central word. Through multiple iterative training, the model will make words with similar contexts closer in the vector space, and learn the best embedding representation of each word, represented by the optimal weight matrix from the input layer to the hidden layer.

[0072] Among them, Word2Vec is a word embedding technology that maps words to high-dimensional vector space through neural networks, which can capture the semantic and contextual relationships between words. Word2Vec converts each word into a vector of fixed dimension, so that semantically similar words are closer in the vector space, thus enabling more effective text analysis and processing.

[0073] Among them, Skip-gram Model is a model used to train Word2Vec word embedding, whose goal is to predict its context words by a given central word. Specifically, the Skip-gram model learns the word embedding vector of the central word so that the vector can maximize the probability of occurrence of context words around the central word, thereby generating high-quality word embedding representations.

[0074] S4013: Input the word embedding vector of the same text output by Word2Vec word embedding technology into the bidirectional long short-term memory network to capture the front-end dependency of the text sequence and obtain the accurate word embedding vector.

[0075] Among them, the Bidirectional Long Short-Term Memory Network (BiLSTM) is an enhanced recurrent neural network (RNN) that simultaneously processes the forward and backward information of the input sequence by combining two LSTM (Long Short-Term Memory) layers to capture the bidirectional dependencies between words in the sequence. BiLSTM performs well in text and time series data processing and can more comprehensively understand contextual information.

[0076] Specifically, the word embedding vectors of the same text learned by the Skip-gram model are input into the Bidirectional Long Short-Term Memory Network (BiLSTM) to capture the front-to-back dependency of the text word sequence in a deeper level. Among them, BiLSTM consists of two LSTM sub-networks. The forward LSTM layer and the backward LSTM layer are responsible for processing the input sequence in order and in reverse order respectively to generate their own output sequences, and the two output sequences are merged by concatenation or averaging to form the final output of BiLSTM. BiLSTM can simultaneously capture the dependency information of order and reverse order in the word sequence, enhance the ability to understand the word sequence, and obtain more accurate word embedding representation.

[0077] S4014: Add attention weights to the key parts in the precise word embedding vector through the attention layer.

[0078] Furthermore, the network device user identification model is enhanced to focus on the key parts in the accurate word embedding vector.

[0079] S4015: Through the pooling layer, the precise word embedding vector after adding the attention weight output by the attention layer is summarized to obtain the text feature encoding of the entire text.

[0080] Specifically, through the global average pooling layer, the precise word embedding vectors after adding attention weights through the attention layer are summarized to generate a fixed-size text feature representation.

[0081] In the present invention, the semantic information of text features can be deeply captured through word segmentation, Word2Vec, bidirectional long short-term memory network (BiLSTM) and attention mechanism. Such an encoding method can not only retain the semantic relationship of words, but also capture the contextual dependencies, thus improving the expressiveness and accuracy of text features.

[0082] S402: Encode the numerical features by retaining the original format.

[0083] In the present invention, the encoding method that retains the original format can retain the actual numerical information of the numerical features, avoid information loss, and provide original data support for subsequent model training.

[0084] S403: splitting and encoding the composite numerical features.

[0085] In the present invention, by feature splitting and post-encoding, complex composite features can be decomposed into simpler parts, which is convenient for model processing and understanding, while maintaining the comprehensive information of the features.

[0086] S404: Encode the enumeration type features by one-hot encoding.

[0087] In the present invention, the use of one-hot encoding can effectively convert classification features into a format that can be processed by the model, avoiding the negative impact of category features on model training.

[0088] S5: Concatenate the multiple types of protocol features after differential encoding to form a network protocol feature vector of the network protocol data.

[0089] In the present invention, by splicing different types of coding features (such as text type, numerical type, composite numerical type and enumeration type), the information of various types of features can be integrated into a unified feature vector. This fusion can more comprehensively express various aspects of network protocol data and capture more details and contextual information. The spliced ​​feature vector contains multiple types of feature information, thereby increasing the feature dimension. This enables the model to use richer information to learn complex patterns and relationships during training, and improves the model's ability to recognize user categories. Splicing feature vectors allows the model to analyze network protocol data from multiple angles (such as text content, numerical data, classification information, etc.). Such multi-angle analysis can improve the accuracy of the model and enhance its robustness when facing complex and variable data.

[0090] S6: Build a network device user identification model based on deep neural network.

[0091] In the present invention, by constructing a network device user identification model based on a deep neural network, the powerful ability of deep learning can be used to perform automatic feature learning and extraction, process large-scale data, improve recognition accuracy, support intelligent and dynamic recognition, enhance the flexibility of the system, and provide an advanced solution for user identification tasks.

[0092] S7: According to the network protocol feature vector, the user category is predicted through the network device user identification model.

[0093] In a possible implementation, S7 specifically includes sub-steps S701 to S702:

[0094] S701: Input the network protocol feature vector into the fully connected layer and use the ReLU activation function to enable the network device user identification model to learn the nonlinear complex association relationship between various protocol features:

[0095]

[0096] Among them, f(x) represents the ReLU activation function, and x represents the output of each neuron in the fully connected layer.

[0097] In the present invention, by inputting the network protocol feature vector into the fully connected layer and using the ReLU activation function, the model can learn the nonlinear complex relationship between various protocol features. The advantage of the ReLU function is that it can introduce nonlinearity, allowing the model to better capture the complex interactions between features, rather than relying solely on linear relationships. This improves the expressiveness and accuracy of the model.

[0098] S702: Define the number of neurons in the output layer to be equal to the number of user categories in the user identification task, and use the Softmax activation function to predict the probability that the network protocol feature vector belongs to each user category:

[0099]

[0100] Among them, p i represents the probability that the network protocol feature vector belongs to the i-th user category, z i represents the score of the i-th user category, z j The score of the j-th user category.

[0101] In the present invention, the Softmax activation function is used to predict the probability of each user category, which can effectively map the network protocol feature vector to different user category probability distributions. The Softmax function can assign a probability value to each user category, so that the model can perform multi-category classification and output the confidence of each category, thereby providing accurate classification results.

[0102] In a possible implementation, S7 specifically further includes sub-step S703:

[0103] S703: By introducing a Dropout layer, some protocol features are randomly discarded during the training process of the network device user identification model.

[0104] Among them, the Dropout layer is a deep learning regularization technique used to prevent overfitting of neural networks during training. It reduces the dependency between neurons by randomly "discarding" some neurons in the network (i.e. setting their outputs to zero) in each training iteration, thereby enhancing the generalization ability of the model. Doing so helps make the model more robust and improves performance on unseen data.

[0105] Specifically, by introducing the Dropout layer, some protocol features are randomly discarded during the training process of the network device user identification model to enhance the generalization ability of the model and prevent overfitting.

[0106] In the present invention, the introduction of the Dropout layer can effectively prevent the overfitting of the model by randomly discarding some protocol features. The Dropout layer randomly ignores some neurons during the training process, thereby reducing the model's dependence on training data, allowing the model to better generalize to unseen data. This regularization technique enhances the robustness and generalization ability of the model.

[0107] S8: Compare the user category prediction result with the user category labeling result, and iteratively train the network device user recognition model.

[0108] In a possible implementation, S8 specifically includes sub-steps S801 to S802:

[0109] S801: Construct a sparse multi-classification cross entropy loss function with the goal of minimizing the difference between the user category prediction result and the user category labeling result.

[0110] Among them, the sparse multi-classification cross entropy loss function is specifically:

[0111]

[0112] Among them, SCCE represents the sparse multi-classification cross entropy loss function, m represents the total number of samples, k represents the total number of user categories, and y ij Indicates the user category labeling result, Represents the user category prediction result.

[0113] In the present invention, the sparse multi-classification cross entropy loss function is used as the optimization target, which can effectively measure the difference between the predicted result and the actual annotation. This loss function can accurately evaluate the prediction accuracy of the model when dealing with multi-classification problems, thereby promoting the optimization of the model in a more accurate direction. The actual categories in the sparse cross entropy loss function are integer encoded without the need for one-hot encoding, thereby reducing memory overhead and improving computational efficiency.

[0114] S802: According to the sparse multi-classification cross entropy loss function, the parameters of the network device user identification model are adjusted by a gradient descent method.

[0115] It should be noted that when training the network device user identification model, the neuron weights and bias network parameters will increase significantly as the complexity of the network device user identification model increases, which is prone to overfitting. Therefore, during the training process, the early stopping method is used to prevent the network device user identification model from overfitting, that is, the labeled data set is divided into a training set and a validation set, the network device user identification model is trained on the training set, and the performance of the network device user identification model is verified on the validation set. When the performance of the network device user identification model on the validation set has not improved for several consecutive iterations, the training is terminated in time.

[0116] In the present invention, the loss function can be efficiently optimized by adjusting the model parameters through the gradient descent method. The gradient descent method minimizes the loss function by continuously updating the weights and bias values, thereby improving the accuracy and generalization ability of the model. The early stopping method (i.e., monitoring the performance on the validation set and terminating the training when the performance no longer improves) during the training process can effectively prevent the overfitting of the model. The early stopping method ensures the generalization ability of the model on unseen data by maintaining the monitoring of the validation set during the training process, thereby improving the practical application performance of the model.

[0117] S9: collect real-time network protocol data generated when the user interacts with the network device, and convert the real-time network protocol data into a real-time network protocol feature vector.

[0118] In the present invention, by collecting and processing network protocol data in real time, the system can identify and classify users at the moment of interaction with network devices, thereby providing instant user identification capabilities. Real-time data processing enables the model to quickly adapt to changes in user behavior and update user features and identification results in a timely manner. This dynamic adjustment can ensure that the model remains efficient and accurate in the face of changes in user behavior and network environment. The conversion of real-time data into feature vectors allows the model to adapt to various network environments and changes in user behavior. This adaptability makes the model more practical in actual applications and able to handle changing network conditions.

[0119] S10: According to the real-time network protocol feature vector, the unknown user category is identified through the trained network device user identification model.

[0120] In the present invention, the trained model can be used to automatically identify and classify unknown users, reducing the need for manual intervention and improving the automation and intelligence level of the system. This enables the system to process large-scale user data without requiring a large amount of human resources. Real-time feature vector input enables the model to dynamically adapt to and identify changing user behaviors and network environments. This adaptability ensures that the model remains efficient and accurate when faced with new or changing user behaviors. By identifying unknown user categories, the system can make data-driven decisions based on user behavior and categories, such as adjusting network policies, optimizing resource allocation, etc., thereby improving the operational efficiency of the system.

[0121] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0122] In the present invention, by collecting network protocol data generated when users interact with network devices, the problem of IP addresses being susceptible to forgery and dynamic changes is overcome, and the accuracy and security of user identification can be ensured. By performing protocol parsing on the network protocol data, various types of protocol features are obtained, and user categories are labeled on the network protocol data based on the protocol features. The various types of protocol features are differentially encoded, thereby avoiding the problems of incomplete collected user data and data heterogeneity, and ensuring the integrity and consistency of device user information.

[0123] Reference Manual Attached Figure 2 , showing a structural schematic diagram of a network device user identification system based on network protocol analysis provided by the present invention.

[0124] The present invention further provides a network device user identification system 30 based on network protocol analysis, comprising: a memory 303 and one or more processors 301 .

[0125] The memory 303 stores one or more application programs, and the one or more application programs are suitable for being executed by the one or more processors 301 to implement the network device user identification method based on network protocol analysis described in the method embodiment.

[0126] The network device user identification system 30 based on network protocol analysis includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, for example, through a bus 302.

[0127] The structure of the network device user identification system 30 based on network protocol analysis does not constitute a limitation on the embodiment of the present invention.

[0128] Processor 301 may be a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of the present invention. Processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0129] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI bus or an EISA bus, etc. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0130] The memory 303 can be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an EEPROM, a CD-ROM or other optical disk storage, an optical disk storage (including a compressed optical disk, a laser disk, an optical disk, a digital versatile disk, a Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0131] It should be noted that the network device user identification system 30 based on network protocol analysis can implement the above-mentioned network device user identification method based on network protocol analysis, and can achieve the same or similar technical effects. To avoid repetition, the present invention will not go into details.

[0132] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0133] In the present invention, by collecting network protocol data generated when users interact with network devices, the problem of IP addresses being susceptible to forgery and dynamic changes is overcome, and the accuracy and security of user identification can be ensured. By performing protocol parsing on the network protocol data, various types of protocol features are obtained, and user categories are labeled on the network protocol data based on the protocol features. The various types of protocol features are differentially encoded, thereby avoiding the problems of incomplete collected user data and data heterogeneity, and ensuring the integrity and consistency of device user information.

[0134] The present invention also provides a computer-readable storage medium on which a computer program is stored. The computer program can be loaded and executed by a processor according to the network device user identification method based on network protocol analysis as described in the first aspect.

[0135] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0136] There are a few points to note:

[0137] (1) The drawings of the embodiments of the present invention only involve structures related to the embodiments of the present invention. Other structures may refer to conventional designs.

[0138] (2) For the sake of clarity, in the drawings used to describe the embodiments of the present invention, the thickness of layers or regions is exaggerated or reduced, that is, these drawings are not drawn according to the actual scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being "on" or "under" another element, the element may be "directly" "on" or "under" the other element or there may be intermediate elements.

[0139] (3) In the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other to obtain new embodiments.

[0140] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network device user identification method based on network protocol analysis, characterized in that: include: S1: collects network protocol data generated when users interact with network devices; S2: performing protocol parsing on the network protocol data to obtain various types of protocol features; S3: marking the network protocol data with user categories according to the protocol characteristics; S4: differentially encoding the multiple types of protocol features; S5: splicing the multiple types of protocol features after differential encoding to form a network protocol feature vector of the network protocol data; S6: Build a network device user identification model based on deep neural network; S7: predicting the user category according to the network protocol feature vector and the network device user identification model; S8: comparing the user category prediction result with the user category labeling result, and iteratively training the network device user recognition model; S9: collecting real-time network protocol data generated when the user interacts with the network device, and converting the real-time network protocol data into a real-time network protocol feature vector; S10: According to the real-time network protocol feature vector, the unknown user category is identified through the trained network device user identification model.

2. The method for identifying network device users based on network protocol analysis according to claim 1, characterized in that: The protocol features include text features, numerical features, composite numerical features and enumeration features.

3. The method for identifying network device users based on network protocol analysis according to claim 1, characterized in that: The S3 specifically includes: S301: Screening and deleting redundant protocol features in various network protocol data; S302: extracting common protocol features and unique protocol features from various network protocol data; S303: Completing the protocol features in other types of network protocol data according to the unique protocol features in each type of network protocol data; S304: Cleaning the various network protocol data after the protocol features are completed; S305: Labeling the various types of network protocol data after data cleaning by user categories.

4. The method for identifying network device users based on network protocol analysis according to claim 2, characterized in that: The S4 specifically includes: S401: Encoding the text-type features by natural science language processing technology; S402: Encoding the numerical feature in a manner of retaining the original format; S403: splitting and encoding the composite numerical features; S404: Encode the enumeration feature by one-hot encoding.

5. The method for identifying network device users based on network protocol analysis according to claim 4, characterized in that: The S401 specifically includes: S4011: Segment the text-type features using a word segmentation technique to obtain an ordered vocabulary list corresponding to the text; S4012: Converting the words in the ordered word list into word embedding vectors by using Word2Vec word embedding technology; S4013: inputting the word embedding vector of the same text segment output by the Word2Vec word embedding technology into a bidirectional long short-term memory network to capture the front-to-back dependency of the text sequence and obtain an accurate word embedding vector; S4014: adding attention weights to key parts of the precise word embedding vector through an attention layer; S4015: Through the pooling layer, the precise word embedding vectors after adding the attention weights output by the attention layer are summarized to obtain the text feature encoding of the entire text.

6. The method for identifying network device users based on network protocol analysis according to claim 1, characterized in that: The S7 specifically includes: S701: Input the network protocol feature vector into the fully connected layer, and use the ReLU activation function to enable the network device user identification model to learn the nonlinear complex association relationship between various protocol features: ； Where f(x) represents the ReLU activation function, and x represents the output of each neuron in the fully connected layer; S702: Define the number of neurons in the output layer to be equal to the number of user categories in the user identification task, and use the Softmax activation function to predict the probability that the network protocol feature vector belongs to each user category: ； Among them, p i represents the probability that the network protocol feature vector belongs to the i-th user category, z i represents the score of the i-th user category, z j The score of the j-th user category.

7. The method for identifying network device users based on network protocol analysis according to claim 6, characterized in that: The S7 specifically includes: S703: By introducing a Dropout layer, some protocol features are randomly discarded during the training process of the network device user identification model.

8. The method for identifying network device users based on network protocol analysis according to claim 1, characterized in that: The S8 specifically includes: S801: constructing a sparse multi-classification cross entropy loss function with the goal of minimizing the difference between the user category prediction result and the user category labeling result; S802: According to the sparse multi-classification cross entropy loss function, adjust the parameters of the network device user identification model by gradient descent method.

9. The method for identifying network device users based on network protocol analysis according to claim 8, characterized in that: The sparse multi-classification cross entropy loss function is specifically: ； Among them, SCCE represents the sparse multi-classification cross entropy loss function, m represents the total number of samples, k represents the total number of user categories, and y ij Indicates the user category labeling result, Represents the user category prediction result.

10. A network device user identification system based on network protocol analysis, characterized in that: include: memory and one or more processors; One or more application programs are stored in the memory, and the one or more application programs are suitable for being executed by the one or more processors to implement the network device user identification method based on network protocol analysis as described in any one of claims 1 to 9.

Images