A method and system for identifying users of network devices based on network protocol analysis

Abstract

The present invention provides a method and system for identifying network device users based on network protocol analysis, which relates to the technical field of network device user identification. The method includes: collecting network protocol data generated when a user interacts with a network device; performing protocol parsing on the network protocol data to obtain protocol features; performing user category annotation on the network protocol data according to the protocol features; performing differential encoding and splicing on the protocol features to form a network protocol feature vector; constructing a network device user identification model based on a deep neural network, and predicting the user category according to the network protocol feature vector; comparing the user category prediction result with the user category annotation result to perform iterative training on the network device user identification model; collecting real-time network protocol data generated when a user interacts with a network device and converting it into a real-time network protocol feature vector; and identifying the unknown user category through the trained network device user identification model.

Description

Technical Field

[0001] The present invention relates to the technical field of user identification of network devices, and particularly to a method and system for identifying network device users based on network protocol analysis. Background Art

[0002] With the progress of the times, the computer and Internet technologies have developed rapidly, and the number of devices and users in the network space has been increasing and becoming increasingly diverse, such as smart phones, computers, smart home devices, etc. People widely interact with diverse networked devices through the Internet, and the network space has become an important part of people's lives and work. However, the vastness and complexity of this network ecosystem also bring many security risks. Malicious behaviors such as hacker attacks, online frauds, and virus infections frequently occur in the network space, resulting in user privacy leakage, malicious control of devices, and even threats to the security of countries and society. Therefore, exploring efficient and accurate network space device user identification technologies has become an important task for maintaining network space security.

[0003] However, due to the fact that traditional user identification methods are based on IP addresses, they are vulnerable to the influence of forged and dynamically changing IP addresses, and cannot ensure the accuracy and security of user identification. In addition, in the actual Internet, due to factors such as user privacy protection, the collected user data is incomplete and heterogeneous, thus affecting the integrity and consistency of device user information. Summary of the Invention

[0004] In order to solve the technical problems that traditional user identification methods are based on IP addresses, are vulnerable to the influence of forged and dynamically changing IP addresses, and cannot ensure the accuracy and security of user identification. In addition, in the actual Internet, due to factors such as user privacy protection, the collected user data is incomplete and heterogeneous, thus affecting the integrity and consistency of device user information, the present invention provides a method and system for identifying network device users based on network protocol analysis.

[0005] The technical solutions provided by the embodiments of the present invention are as follows:

[0006] First aspect:

[0007] A method for identifying network device users based on network protocol analysis provided by an embodiment of the present invention includes:

[0008] S1: Collect network protocol data generated when a user interacts with a network device;

[0009] S2: Perform protocol parsing on the network protocol data to obtain various types of protocol features;

[0010] S3: Label the user category of the network protocol data according to the protocol features;

[0011] S4: Differentially encode the multiple types of protocol features;

[0012] S5: Concatenate the differentially encoded multiple types of protocol features to form a network protocol feature vector of the network protocol data;

[0013] S6: Construct a network device user identification model based on a deep neural network;

[0014] S7: Predict the user category according to the network protocol feature vector through the network device user identification model;

[0015] S8: Compare the user category prediction result with the user category labeling result, and iteratively train the network device user identification model;

[0016] S9: Collect real-time network protocol data generated when a user interacts with a network device, and convert the real-time network protocol data into a real-time network protocol feature vector;

[0017] S10: Identify the unknown user category according to the real-time network protocol feature vector through the trained network device user identification model.

[0018] Second aspect:

[0019] A network device user identification system based on network protocol analysis provided by an embodiment of the present invention includes: a memory and one or more processors;

[0020] One or more application programs are stored in the memory, and the one or more application programs are adapted to be executed by the one or more processors to implement the above-mentioned network device user identification method based on network protocol analysis.

[0021] The beneficial effects brought by the technical solution provided by the embodiment of the present invention at least include:

[0022] In the present invention, by collecting network protocol data generated when a user interacts with a network device, the influence of being easily affected by forged and dynamically changing IP addresses is overcome, and the accuracy and security of user identification can be ensured. By performing protocol parsing on the network protocol data, multiple types of protocol features are obtained. According to the protocol features, the user category of the network protocol data is labeled, and the multiple types of protocol features are differentially encoded, avoiding incomplete user data and data heterogeneity problems, and ensuring the integrity and consistency of device user information. Description of the Drawings

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the accompanying drawings required for the description of the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can be obtained based on these drawings.

[0024] Figure 1 It is a schematic flowchart of a method for identifying network device users based on network protocol analysis provided by an embodiment of the present invention;

[0025] Figure 2 It is a schematic structural diagram of a system for identifying network device users based on network protocol analysis provided by an embodiment of the present invention. Detailed implementation manners

[0026] The following describes the technical solutions in the present invention with reference to the accompanying drawings.

[0027] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to represent examples, illustrations or explanations. Any embodiment or design solution described as "example" in the present invention should not be construed as being more preferred or having more advantages than other embodiments or design solutions. Exactly speaking, the use of the word "example" aims to present concepts in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one of the two.

[0028] To make the technical problems, technical solutions and advantages to be solved by the present invention clearer, the following will be described in detail with reference to the accompanying drawings and specific embodiments.

[0029] Referring to the attached Figure 1 It shows a schematic flowchart of a method for identifying network device users based on network protocol analysis provided by an embodiment of the present invention.

[0030] The embodiments of the present invention provide a method for identifying network device users based on network protocol analysis. This method can be implemented by a network device user identification device based on network protocol analysis. The network device user identification device based on network protocol analysis can be a terminal or a server. The processing flow of the method for identifying network device users based on network protocol analysis can include the following steps:

[0031] S1: Collect network protocol data generated when a user interacts with a network device.

[0032] Specifically, detect and collect multiple network protocol data generated when different users in a specific region on the Internet interact with different network devices.

[0033] Optionally, each network protocol data includes an IP address, port information, and device location.

[0034] It should be noted that when different users interact with different network devices, they will be based on different types of network protocols, and different network protocols have different protocol structures.

[0035] Optionally, the network protocols include HTTP, HTTPS, SSH, and RTSP.

[0036] Among them, HTTP (Hypertext Transfer Protocol) is the hypertext transfer protocol, which is used to transfer web page data on the Internet. It defines how a client (usually a browser) and a server request and transfer web pages and their related resources. HTTP is a stateless protocol, meaning that each request and response is independent and does not retain any context of previous requests.

[0037] Among them, HTTPS (Hypertext Transfer Protocol Secure) is a secure version of HTTP. By adding the SSL / TLS protocol to HTTP, it encrypts data transmission to ensure that data is not eavesdropped on or tampered with during the transmission process between the client and the server. HTTPS provides data encryption, identity authentication, and data integrity protection, and is the standard protocol for protecting Internet communication security.

[0038] Among them, SSH (Secure Shell) is a protocol for secure remote login and command execution. It provides a secure network communication channel through encryption technology, allowing users to securely connect to remote computers through an insecure network and execute commands, transfer files, etc. SSH is widely used in system management and network management, providing authentication, encryption, and data integrity protection.

[0039] Among them, RTSP (Real-Time Streaming Protocol) is a protocol for controlling streaming media servers, mainly used to establish, control, and terminate streaming media sessions between clients and streaming media servers. RTSP allows clients to perform operations such as playing, pausing, and fast-forwarding on streaming media content, and is widely used in video surveillance and real-time streaming media playback systems.

[0040] In the present invention, by detecting and collecting network protocol data between users in a specific area and different network devices, rich data samples can be obtained. This data covers the interactions of different users and devices, and can more comprehensively reflect the usage scenarios and characteristics of various network protocols. Collecting different types of network protocol data (such as HTTP, HTTPS, SSH, RTSP) can cover the characteristics and structures of various protocols. This can ensure that the model has stronger adaptability when facing different protocol types, thereby improving the accuracy and robustness of user identification.

[0041] S2: Perform protocol parsing on the network protocol data to obtain various types of protocol features.

[0042] Among them, the protocol features include text-based features, numerical features, composite numerical features, and enumerated features.

[0043] In the present invention, each feature type has different expression forms and information contents. For example, text-based features can reflect the commands and request contents in the protocol, numerical features can provide quantitative data such as network traffic size or timestamp, composite numerical features can combine the relationships of multiple numerical features, and enumerated features can identify the states or options in the protocol. This diverse feature expression can more accurately describe the complexity of network protocols. Different feature types allow the use of different analysis and processing techniques. For example, text-based features can be processed using natural language processing techniques, numerical features can be statistically analyzed, and enumerated features can be classified. By combining these different processing methods, the network protocol data can be more deeply mined and analyzed.

[0044] S3: Label the user categories of the network protocol data according to the protocol features.

[0045] In a possible implementation manner, S3 specifically includes sub-steps S301 to S305:

[0046] S301: Screen and delete redundant protocol features in various types of network protocol data.

[0047] It should be noted that the redundant protocol features are protocol features that are not helpful for user identification, including the "createDate" field of the network protocol data creation time and the "osCategory" field of the operating system category.

[0048] Among them, the "createDate" field (Creation Date) of the network protocol data creation time: This field records the specific date and time when the network protocol data is generated or captured. It helps to track the timeliness of the data, ensure the real-time nature and effectiveness of the data, and is also used for time sorting and filtering during data management and analysis.

[0049] Among them, the "osCategory" field (Operating System Category) of the operating system category: This field describes the type or category of the operating system running on the device that generates network protocol data. It provides information about the device's operating environment, helps with network security analysis and device management, and identifies the potential impact of different operating systems on network protocols.

[0050] Specifically, initially manually screen and delete protocol features in various types of network protocol data that are not helpful for user identification.

[0051] In the present invention, by screening and deleting redundant protocol features (such as "createDate" and "osCategory") that are not helpful for user identification, it is possible to reduce interference from irrelevant information in model training, focus on features that are actually helpful for user identification, and improve data quality and analysis accuracy.

[0052] S302: Extract common protocol features and unique protocol features from various types of network protocol data.

[0053] In the present invention, extracting common protocol features and unique protocol features helps to understand the commonalities and uniqueness of all protocols in the data, ensures that the features of each network protocol are fully considered, and enhances the model's adaptability to different protocols.

[0054] S303: For the unique protocol features in various types of network protocol data, complete the protocol features in the network protocol data of other types.

[0055] Specifically, for the unique protocol features in various types of network protocol data, complete the protocol features in the network protocol data of other types, so as to ensure that all network protocol data follows the same data structure and retains the key features of network protocol data including IP address (IP Address), port information (Port Information), protocol type (protocol), transport protocol (transProtocol), protocol banner (Banner), and device location (deviceLocation).

[0056] In the present invention, by completing the unique protocol features in other types of protocol data to unify the data structure, making all data follow the same format and structure, it helps the model to process and analyze data from different sources and improves the consistency and accuracy of identification.

[0057] S304: Perform data cleaning on various types of network protocol data after protocol feature completion.

[0058] Optionally, the data cleaning methods include missing value filling and data format standardization to ensure the integrity and consistency of network protocol data.

[0059] In the present invention, during the data cleaning process, missing value filling and data format standardization are used to ensure data consistency and integrity, further improving data quality and laying a solid foundation for subsequent analysis and model training.

[0060] S305: Perform user category annotation on various types of network protocol data after data cleaning.

[0061] Specifically, based on the mastered expert knowledge, perform manual user category annotation on various types of network protocol data after data cleaning.

[0062] It should be noted that the mastered expert knowledge refers to professional knowledge, experience, and skills that can help experts make accurate judgments during the data annotation process.

[0063] In the present invention, using expert knowledge to perform manual annotation on data can make full use of the experience and skills of domain experts to ensure the accuracy of annotation. Expert knowledge can help identify complex patterns and subtle differences in the data, thereby improving the accuracy of user category annotation.

[0064] S4: Differentially encode various types of protocol features.

[0065] In a possible implementation manner, S4 specifically includes sub-steps S401 to S404:

[0066] S401: Encode text-based features through natural science language processing technology.

[0067] Optionally, the natural science language processing technology includes word segmentation technology, Word2Vec word embedding technology, bidirectional long short-term memory network, and attention mechanism.

[0068] In a possible implementation manner, S401 specifically includes sub-steps S4011 to S4015:

[0069] S4011: Segment text-based features through word segmentation technology to obtain an ordered vocabulary list corresponding to the text.

[0070] S4012: Convert the words in the ordered vocabulary list into word embedding vectors through Word2Vec word embedding technology.

[0071] Specifically, the Skip-gram model, a typical architecture of Word2Vec, is adopted to implement the word embedding operation. In the Skip-gram model, each word is represented as a word embedding vector of a fixed dimension. During the training process, the input of the Skip-gram model is a center word, and the goal is to predict the context words within the window around this word. Given the center word, the probability of the context words appearing is maximized. The Skip-gram model takes the one-hot encoded vector of the center word as the input. The vector dimension is the number of words in the vocabulary. The number of neurons in the hidden layer is much smaller than that in the input layer. The output layer represents the one-hot encoded vectors of the context words around the center word. Through multiple iterations of training, the model will make words with similar context closer in the vector space and learn the optimal embedding representation for each word, which is represented by the optimal weight matrix from the input layer to the hidden layer.

[0072] Among them, Word2Vec is a word embedding technology that maps words to a high-dimensional vector space through a neural network. It can capture the semantic and context relationships between words. By converting each word into a vector of a fixed dimension, Word2Vec makes words with similar semantics closer in the vector space, thus enabling more effective text analysis and processing.

[0073] Among them, the Skip-gram Model is a model for training Word2Vec word embeddings. Its goal is to predict the context words given a center word. Specifically, the Skip-gram model learns the word embedding vector of the center word so that this vector can maximize the probability of the context words around the center word appearing, thereby generating high-quality word embedding representations.

[0074] S4013: Input the word embedding vectors of the same text output by the Word2Vec word embedding technology into a bidirectional long short-term memory network to capture the forward and backward dependencies of the text sequence and obtain accurate word embedding vectors.

[0075] Among them, the Bidirectional Long Short-Term Memory Network (BiLSTM) is an enhanced recurrent neural network (RNN). By combining two Long Short-Term Memory (LSTM) layers, it processes the forward and backward information of the input sequence simultaneously to capture the bidirectional dependencies between words in the sequence. BiLSTM performs well in text and time series data processing and can comprehensively understand context information.

[0076] Specifically, the word embedding vectors of the same text learned by the Skip-gram model are input into a bidirectional long short-term memory network (BiLSTM) to capture the forward and backward dependencies of the text vocabulary sequence more deeply. Among them, the BiLSTM consists of two LSTM sub-networks. The forward LSTM layer and the backward LSTM layer are responsible for processing the input sequence in sequence and reverse order respectively to generate their respective output sequences, and the two output sequences are combined by means of splicing or averaging to form the final output of the BiLSTM. The BiLSTM can capture both the sequential and reverse dependencies in the vocabulary sequence, enhance the understanding ability of the vocabulary sequence, and obtain a more accurate word embedding representation.

[0077] S4014: Through the attention layer, add attention weights to the key parts in the accurate word embedding vectors.

[0078] Furthermore, enhance the attention of the network device user identification model to the key parts in the accurate word embedding vectors.

[0079] S4015: Through the pooling layer, summarize the accurate word embedding vectors with attention weights output by the attention layer to obtain the text-type feature encoding of the entire text.

[0080] Specifically, through the global average pooling layer, summarize the accurate word embedding vectors with attention weights added by the attention layer to generate a text-type feature representation of a fixed size.

[0081] In the present invention, through word segmentation, Word2Vec, bidirectional long short-term memory network (BiLSTM) and attention mechanism, the semantic information of text-type features can be deeply captured. Such an encoding method can not only retain the semantic relationship of vocabulary, but also capture the forward and backward dependencies of context, improving the expression ability and accuracy of text-type features.

[0082] S402: Encode the numerical features by retaining the original format.

[0083] In the present invention, the encoding method of retaining the original format can retain the actual numerical information of the numerical features, avoid information loss, and at the same time provide original data support for subsequent model training.

[0084] S403: Encode the composite numerical features after feature splitting.

[0085] In the present invention, through encoding after feature splitting, complex composite features can be decomposed into simpler parts, which is convenient for the model to process and understand, and at the same time retains the comprehensive information of the features.

[0086] S404: Encode the enumerated features by one-hot encoding.

[0087] In the present invention, one-hot encoding can effectively convert categorical features into a format that the model can handle, avoiding the negative impact of categorical features on model training.

[0088] S5: Concatenate the protocol features of multiple types after differential encoding to form a network protocol feature vector of network protocol data.

[0089] In the present invention, by concatenating different types of encoded features (such as text type, numerical type, composite numerical type, and enumeration type), the information of various types of features can be integrated into a unified feature vector. This fusion can more comprehensively express all aspects of network protocol data, capturing more details and context information. The concatenated feature vector contains various types of feature information, thereby increasing the feature dimension. This enables the model to utilize richer information during the training process to learn complex patterns and relationships, improving the model's ability to identify user categories. The concatenated feature vector allows the model to analyze network protocol data from multiple perspectives (such as text content, numerical data, classification information, etc.). Such multi-perspective analysis can improve the accuracy of the model and enhance its robustness in the face of complex and variable data.

[0090] S6: Construct a network device user identification model based on a deep neural network.

[0091] In the present invention, by constructing a network device user identification model based on a deep neural network, the powerful capabilities of deep learning can be utilized for automatic feature learning and extraction, processing large-scale data, improving identification accuracy, supporting intelligent and dynamic identification, enhancing the flexibility of the system, and providing an advanced solution for the user identification task.

[0092] S7: Predict the user category based on the network protocol feature vector through the network device user identification model.

[0093] In a possible implementation manner, S7 specifically includes sub-steps S701 to S702:

[0094] S701: Input the network protocol feature vector into the fully connected layer and use the ReLU activation function to enable the network device user identification model to learn the non-linear complex association relationships between various protocol features:

[0095]

[0096] Among them, f(x) represents the ReLU activation function, and x represents the output of each neuron in the fully connected layer.

[0097] In the present invention, by inputting the network protocol feature vector into the fully connected layer and using the ReLU activation function, the model can learn the non-linear complex relationships between various protocol features. The advantage of the ReLU function is that it can introduce non-linearity, enabling the model to better capture the complex interactions between features rather than relying solely on linear relationships. This improves the expressive power and accuracy of the model.

[0098] S702: Define the number of neurons in the output layer to be equal to the number of user categories in the user identification task, and use the Softmax activation function to predict the probabilities that the network protocol feature vector belongs to each user category:

[0099]

[0100] where p i represents the probability that the network protocol feature vector belongs to the i-th user category, and z i represents the score of the i-th user category, and z j is the score of the j-th user category.

[0101] In the present invention, using the Softmax activation function to predict the probabilities of each user category can effectively map the network protocol feature vector into different user category probability distributions. The Softmax function can assign a probability value to each user category, enabling the model to perform multi-class classification and output the confidence of each category, thereby providing accurate classification results.

[0102] In a possible implementation manner, S7 specifically further includes sub-step S703:

[0103] S703: By introducing a Dropout layer, randomly discard some protocol features during the training process of the network device user identification model.

[0104] Among them, the Dropout layer is a deep learning regularization technique used to prevent overfitting in the neural network. It randomly "discards" some neurons in the network (i.e., sets their outputs to zero) in each training iteration to reduce the dependence between neurons, thereby enhancing the generalization ability of the model. Doing so helps make the model more robust and improve its performance on unseen data.

[0105] Specifically, by introducing a Dropout layer, randomly discard some protocol features during the training process of the network device user identification model to enhance the generalization ability of the model and prevent overfitting.

[0106] In the present invention, by introducing a Dropout layer to randomly discard some protocol features, overfitting of the model can be effectively prevented. The Dropout layer randomly ignores some neurons during the training process, thereby reducing the model's dependence on the training data and enabling the model to better generalize to unseen data. This regularization technique enhances the robustness and generalization ability of the model.

[0107] S8: Compare the user category prediction result with the user category annotation result, and perform iterative training on the network device user identification model.

[0108] In a possible implementation manner, S8 specifically includes sub-steps S801 to S802:

[0109] S801: With the goal of minimizing the difference between the user category prediction result and the user category annotation result, construct a sparse multi-class cross-entropy loss function.

[0110] Among them, the sparse multi-class cross-entropy loss function is specifically:

[0111]

[0112] Among them, SCCE represents the sparse multi-class cross-entropy loss function, m represents the total number of samples, k represents the total number of user categories, y ij represents the user category annotation result, represents the user category prediction result.

[0113] In the present invention, using the sparse multi-class cross-entropy loss function as the optimization goal can effectively measure the difference between the prediction result and the actual annotation. This loss function can accurately evaluate the prediction accuracy of the model when dealing with multi-class problems, thereby promoting the model to be optimized in a more accurate direction. The actual category in the sparse cross-entropy loss function uses integer encoding without one-hot encoding, so it can reduce memory overhead and improve calculation efficiency.

[0114] S802: According to the sparse multi-class cross-entropy loss function, adjust the parameters of the network device user identification model by the gradient descent method.

[0115] It should be noted that when training the network device user identification model, the neuron weights and bias value network parameters will increase significantly as the complexity of the network device user identification model increases, and overfitting is likely to occur. Therefore, during the training process, the early stopping method is adopted to prevent the network device user identification model from overfitting, that is, the labeled data set is divided into a training set and a validation set. The network device user identification model is trained on the training set, and the performance of the network device user identification model is verified on the validation set. When the performance of the network device user identification model on the validation set does not improve for several consecutive iterations, the training is terminated in a timely manner.

[0116] In the present invention, by using the gradient descent method to adjust the model parameters, the loss function can be efficiently optimized. The gradient descent method minimizes the loss function by continuously updating the weights and bias values, thereby improving the accuracy and generalization ability of the model. During the training process, the early stopping method (i.e., monitoring the performance on the validation set and terminating the training when the performance no longer improves) can effectively prevent the overfitting phenomenon of the model. The early stopping method ensures the generalization ability of the model on unseen data by continuously monitoring the validation set during the training process, thereby improving the practical application performance of the model.

[0117] S9: Collect the real-time network protocol data generated when the user interacts with the network device, and convert the real-time network protocol data into real-time network protocol feature vectors.

[0118] In the present invention, by collecting and processing the network protocol data in real time, the system can identify and classify at the moment when the user interacts with the network device, thereby providing instant user identification ability. The real-time data processing enables the model to quickly adapt to the changes in user behavior and update the user features and identification results in a timely manner. This dynamic adjustment can ensure that the model remains efficient and accurate in the face of changes in user behavior and network environment. The conversion of real-time data into feature vectors enables the model to adapt to various network environments and changes in user behavior. This adaptability makes the model more practical in actual applications and can handle constantly changing network conditions.

[0119] S10: According to the real-time network protocol feature vectors, use the trained network device user identification model to identify the unknown user category.

[0120] In the present invention, using the trained model can automatically identify and classify unknown users, reducing the need for manual intervention and improving the automation level and intelligence degree of the system. This enables the system to process a large amount of user data without requiring a large amount of human resources. The input of real-time feature vectors enables the model to dynamically adapt to and identify changing user behavior and network environment. This adaptability ensures that the model remains efficient and accurate in the face of new or changing user behavior. By identifying the unknown user category, the system can make data-driven decisions based on user behavior and category, such as adjusting network policies, optimizing resource allocation, etc., thereby improving the operation efficiency of the system.

[0121] The beneficial effects brought by the technical solution provided by the embodiment of the present invention at least include:

[0122] In the present invention, by collecting network protocol data generated when a user interacts with a network device, the problem of being vulnerable to the forgery and dynamic change of IP addresses is overcome, and the accuracy and security of user identification can be ensured. By performing protocol analysis on the network protocol data, various types of protocol features are obtained. According to the protocol features, user category annotation is performed on the network protocol data, and differential coding is performed on the various types of protocol features, avoiding the problems of incomplete collected user data and data heterogeneity, and ensuring the integrity and consistency of device user information.

[0123] Refer to the attached Figure 2 illustrates a schematic structural diagram of a network device user identification system provided by the present invention based on network protocol analysis.

[0124] The present invention also provides a network device user identification system 30 based on network protocol analysis, including: a memory 303 and one or more processors 301.

[0125] One or more application programs are stored in the memory 303, and the one or more application programs are adapted to be executed by the one or more processors 301 to implement the network device user identification method based on network protocol analysis described in the method embodiments.

[0126] The network device user identification system 30 based on network protocol analysis includes: a processor 301 and a memory 303. Among them, the processor 301 and the memory 303 are connected, such as connected through a bus 302.

[0127] The structure of the network device user identification system 30 based on network protocol analysis does not constitute a limitation to the embodiments of the present invention.

[0128] The processor 301 can be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in combination with the disclosure of the present invention. The processor 301 can also be a combination for implementing computing functions, such as a combination including one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0129] The bus 302 can include a path for transmitting information between the above components. The bus 302 can be a PCI bus or an EISA bus, etc. The bus 302 can be divided into an address bus, a data bus, a control bus, etc. For the sake of representation, only a thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0130] The memory 303 can be a ROM or other types of static storage devices that can store static information and instructions, a RAM or other types of dynamic storage devices that can store information and instructions, or an EEPROM, a CD-ROM, or other optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium, or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0131] It should be noted that the network device user identification system 30 based on network protocol analysis can implement the above-mentioned network device user identification method based on network protocol analysis and can achieve the same or similar technical effects. To avoid repetition, the present invention will not be elaborated herein.

[0132] The beneficial effects brought by the technical solutions provided in the embodiments of the present invention at least include:

[0133] In the present invention, by collecting network protocol data generated when a user interacts with a network device, it overcomes the vulnerability to the influence of forged and dynamically changing IP addresses, and can ensure the accuracy and security of user identification. By performing protocol parsing on the network protocol data, various types of protocol features are obtained. According to the protocol features, user category annotation is performed on the network protocol data, and differential coding is performed on the various types of protocol features, avoiding the problems of incomplete and heterogeneous user data collection, and ensuring the integrity and consistency of device user information.

[0134] The present invention also provides a computer-readable storage medium, on which a computer program is stored, and the computer program can be loaded and executed by a processor to perform the network device user identification method based on network protocol analysis described in the first aspect.

[0135] As described above, the above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention can easily think of changes or substitutions, which should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

[0136] The following points need to be explained:

[0137] (1) The drawings in the embodiments of the present invention only relate to the structures involved in the embodiments of the present invention, and other structures can refer to the general design.

[0138] (2) For clarity, in the drawings used to describe the embodiments of the present invention, the thickness of layers or regions is enlarged or reduced, that is, these drawings are not drawn to actual scale. It can be understood that when an element such as a layer, film, region, or substrate is referred to as being "on" or "under" another element, the element can be "directly" on or under the other element or there can be intervening elements.

[0139] (3) Without conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other to obtain new embodiments.

[0140] The above is only the specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. The protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for identifying network device users based on network protocol analysis, characterized in that, Including: S1: Collect network protocol data generated when a user interacts with a network device; S2: Parse the network protocol data to obtain various types of protocol features; S3: Label the user category of the network protocol data according to the protocol features; S4: Perform differential encoding on the various types of protocol features; S5: Concatenate the differentially encoded various types of protocol features to form a network protocol feature vector of the network protocol data; S6: Construct a network device user identification model based on a deep neural network; S7: Predict the user category according to the network protocol feature vector through the network device user identification model; S8: Compare the user category prediction result with the user category labeling result, and perform iterative training on the network device user identification model; S9: Collect real-time network protocol data generated when a user interacts with a network device, and convert the real-time network protocol data into a real-time network protocol feature vector; S10: Identify the unknown user category according to the real-time network protocol feature vector through the trained network device user identification model; Among them, the specific content of S3 includes: S301: Screen and delete redundant protocol features in various types of network protocol data; S302: Extract common protocol features and unique protocol features in various types of network protocol data; S303: For the unique protocol features in various types of network protocol data, perform protocol feature complementation in the network protocol data of other types; S304: Perform data cleaning on various types of network protocol data after protocol feature complementation; S305: Label the user category of various types of network protocol data after data cleaning.

2. The method for identifying network device users based on network protocol analysis according to claim 1, wherein The protocol features include text features, numerical features, composite numerical features, and enumerated features.

3. The network device user identification method based on network protocol analysis according to claim 2, characterized in that, The specific content of S4 includes: S401: Encode the text features through natural science language processing technology; S402: Encode the numerical features by retaining the original format; S403: Perform feature splitting and encoding on the composite numerical features; S404: Encode the enumerated features through one-hot encoding.

4. The method for identifying a network device user based on network protocol analysis according to claim 3, wherein The specific content of S401 includes: S4011: Segment the text features through a segmentation technology to obtain an ordered vocabulary list corresponding to the text; S4012: Convert the vocabulary in the ordered vocabulary list into word embedding vectors through the Word2Vec word embedding technology; S4013: Input the word embedding vectors of the same piece of text output by the Word2Vec word embedding technology into a bidirectional long short-term memory network to capture the forward and backward dependencies of the text sequence, and obtain accurate word embedding vectors; S4014: Add attention weights to the key parts in the accurate word embedding vectors through an attention layer; S4015: Summarize the accurate word embedding vectors with attention weights output by the attention layer through a pooling layer to obtain the text feature encoding of the entire piece of text.

5. The network device user identification method based on network protocol analysis according to claim 1, characterized in that The specific content of S7 includes: S701: Input the network protocol feature vector into the fully connected layer and use the ReLU activation function to enable the network device user identification model to learn the non-linear complex association relationships between various protocol features: f(x) = max(0, x) where f(x) represents the ReLU activation function and x represents the output of each neuron in the fully connected layer; S702: Define the number of neurons in the output layer to be equal to the number of user categories in the user identification task and use the Softmax activation function to predict the probabilities that the network protocol feature vector belongs to each user category: where p i represents the probability that the network protocol feature vector belongs to the \(i\)-th user category, and \(z i represents the score of the \(i\)-th user category, and \(z j is the score of the \(j\)-th user category.

6. The method for identifying a user of a network device based on network protocol analysis according to claim 5, wherein S7 specifically further includes: S703: By introducing a Dropout layer, randomly discard some protocol features during the training process of the network device user identification model.

7. The network device user identification method based on network protocol analysis according to claim 1, characterized in that S8 specifically includes: S801: With the goal of minimizing the difference between the user category prediction result and the user category annotation result, construct a sparse multi-class cross-entropy loss function; S802: According to the sparse multi-class cross-entropy loss function, adjust the parameters of the network device user identification model through the gradient descent method.

8. The method for identifying network device users based on network protocol analysis according to claim 7, characterized in that, The sparse multi-class cross-entropy loss function is specifically: Among them, SCCE represents the sparse multi-class cross-entropy loss function, m represents the total number of samples, k represents the total number of user categories, and y ij represents the user category annotation result, and represents the user category prediction result.

9. A network device user identification system based on network protocol analysis, characterized in that, including: a memory and one or more processors; one or more applications are stored in the memory, and the one or more applications are adapted to be executed by the one or more processors to implement the network device user identification method based on network protocol analysis according to any one of claims 1 to 8.

Images